Agentic Settlements and Payments: A Federated Settlement Layer Beneath Machine-Payment Protocols

Software agents can now request, authorise and complete payments through open protocols: HTTP 402 schemes such as x402 and the Machine Payments Protocol (MPP), mandate formats such as AP2, and checkout and tool-calling standards. These protocols standardise the conversation about payment. They leave open where the payment settles and who answers for it. Today the answer is usually a public blockchain, which publishes payer, payee and amount, or the card networks, which are identity-forward and priced for human purchases. Recent security analyses report two kinds of problem. In formal models of the leading protocols as specified, they find missing bindings between authorisation, settlement and fulfilment. In practical attacks on x402, they find races between a synchronous HTTP request and asynchronous settlement. They do not claim that every implementation behaves the same way. This paper proposes a design framework for a different answer: a federated settlement layer beneath the protocols, in which independent, legally named guardians run a Fedimint-style federation whose mint module issues threshold-blind-signed bearer e-cash. We set out requirements for agentic settlement and derive a four-layer reference architecture from them. We describe a protocol-neutral attachment pattern built on three client operations of Fedimint's original mint module (spend, validate, reissue). One variant uses a signed transaction: the payee's HTTP 402 challenge carries its own blinded outputs, and this removes the bearer race when the challenge is authenticated. Two delegation modes are stated as a trade-off. Durability rules govern the one irreversible step. A two-record model keeps an identified account of payments apart from an unlinkable record of value, and we state what it does not achieve. Function-separated federations carry sign-only attestation and bonds. Each component carries its residual risks. No component has been built to the standard the framework requires, and no figure in this paper is measured. We close with hypotheses, each with the result that would refute it, and with the evaluations that would test them. Status. A conceptual preprint: a design framework and research agenda. No system described here operates, no study proposed here has been run, and no figure is measured. Not peer reviewed. Version v0.19 (11 November 2026). This version corrects several statements about Fedimint after a check of its source, makes changes prompted by two cold reads by AI models of other providers, and lists in Appendix F the points that were raised and not changed. The Fedimint-contributing collaborator has reviewed no change made after v0.16; the Disclosure says who checked what.