Every production agent payment stack shipped in 2026 runs three checks before money moves. It verifies who authorized the payment. It verifies which agent is submitting it. It verifies whether the receiving address is sanctioned or associated with known illicit activity.

None of them verify the asset.

The stablecoin the agent is about to accept, hold across a settlement window, or route through a swap is treated as a fixed unit of account. A dollar. Something the system reasons about but does not examine. That assumption was defensible when stablecoins were a handful of fiat-backed tokens with published attestations. It is no longer defensible now that agents transact against hundreds of dollar-denominated instruments with radically different backing, redemption mechanics, and failure modes.

This article defines the gap, explains why autonomous execution makes it materially worse than it is for human operators, and describes what an asset-integrity check looks like when it has to return an answer in under a second.

Definitions first

Agent payment stack: the set of components that let an autonomous software agent initiate, authorize, and settle a payment. In current production deployments this typically includes an agent wallet with programmable spending policy, an identity or mandate layer, a settlement protocol, and a screening layer.

Know Your Agent (KYA-agent): verification that the software agent submitting a payment is a registered identity, currently authorized by a specific human or organizational principal, and operating inside a scoped mandate.

Know Your Transaction (KYT): continuous screening of inbound and outbound transfers against sanctions lists, address risk scores, and typology models.

Know Your Asset (KYA-asset): continuous evaluation of whether a specific onchain instrument is structurally sound right now. Peg integrity, collateral quality, redemption availability, liquidity depth, contract permissions, governance state, and holder concentration.

The acronym collision is real and worth naming plainly. The agentic payments literature uses KYA to mean Know Your Agent. Risk infrastructure uses KYA to mean Know Your Asset. Two different checks, same three letters, and only one of them is built into most agent stacks today.

What the current stack actually verifies

Walk through a representative x402 flow. A server responds with HTTP 402 and a payload naming the chain, the accepted token contract, the amount, and the destination address. The agent's wallet signs an authorization, typically an EIP-3009 transfer authorization on EVM chains, and retries the request with the signed payment attached. A facilitator verifies the signature and submits the transaction. Settlement confirms in seconds on an L2.

At each step there is a check, and each check answers a different question.

The mandate layer asks whether a human authorized this spend, and answers it with AP2 mandates, verifiable credentials, or a signed scope. The identity layer asks whether this is a known and currently authorized agent, and answers it with DIDs, agent directories, or signed HTTP headers. The policy layer asks whether the spend falls inside configured limits, and answers it with contract-level caps, allowlists, velocity limits, and approval thresholds. The counterparty layer asks whether the receiving address is sanctioned or high risk, and answers it with KYT screening and address risk APIs. The execution layer asks whether the transaction will do what it claims, and answers it with simulation.

Then there is a sixth question that almost nothing in the stack asks. Is the token itself sound right now? In most deployments, nothing answers that. There is no component assigned to it.

The reason is a category error. The stack treats "stablecoin" as a property of the asset rather than a claim the asset makes about itself.

One widely read agentic payments explainer makes the assumption explicit: dollar-pegged tokens are described as removing price volatility from the equation, on the grounds that a five percent swing in the settlement asset would be catastrophic for an agent executing hundreds of micropayments an hour. The reasoning is correct. The conclusion does not follow. Stablecoins do not eliminate that risk. They concentrate it into a different shape, one that stays invisible for months and then arrives all at once.

The evidence that "stablecoin" is a category, not a guarantee

November 2025 is the clearest recent case. Elixir's deUSD lost its peg on November 6 after Stream Finance disclosed a loss that impaired the collateral behind it. By the time redemptions were processed for the bulk of holders, the token was trading near a cent and a half. Within hours, Stream Finance's own XUSD broke to roughly twenty cents following a large exploit of a connected protocol that drained the liquidity pools those positions depended on. The same event pushed USDX, a third yield-bearing dollar token from a separate issuer, into the thirty to thirty-eight cent range, cutting its market capitalization by around sixty-five percent in a single day and stressing every protocol that had integrated it as collateral.

Three tokens, three issuers, one shared exposure. Each one called itself a stablecoin. Each one would have passed a naive symbol check.

March 2026 produced a cleaner illustration of the timing problem. Resolv's USR lost ninety-four percent of its value in under an hour following an unbacked minting exploit. Webacy's monitor flagged a thirty-eight percent dislocation at 02:41 UTC and issued a critical alert at 03:04 UTC. Resolv Labs published its public acknowledgment at 04:58 UTC. The gap between the observable onchain condition and the official announcement was two hours and seventeen minutes.

For a human treasury operator, two hours is a tight but workable window. For an agent settling continuously against that asset, two hours is thousands of transactions.

The macro picture matters too. Yield-bearing stablecoin supply fell more than three and a half billion dollars in Q2 2026, a fifteen percent contraction that ended nearly three years of consecutive quarterly growth, with crypto-native products driving the decline while Treasury-backed tokens expanded. Total stablecoin supply fell to roughly three hundred twelve billion, the first quarterly contraction since Q3 2023. That is a market actively re-sorting itself by backing quality. An agent stack with no view of backing quality cannot participate in that sorting.

Why autonomy changes the risk math

The asset-integrity gap exists for human operators too. Autonomy changes three things about it.

Frequency removes the natural circuit breaker. A human treasury manager checks a position a few times a day and notices when something looks wrong. An agent that has been given a mandate and a wallet does not notice anything. It executes. Roughly seventy-six percent of stablecoin transaction volume was already automated by early 2026, and the count of transfers under two hundred fifty dollars rose while retail-sized transfers fell. The composition of stablecoin flow is shifting toward machine-initiated activity precisely as the assets themselves become more heterogeneous.

Settlement finality removes the recovery path. Card rails carry chargeback liability for sixty to a hundred eighty days. Stablecoin transfers are final on confirmation. An agent that accepts a token thirty minutes into a depeg has no reversal mechanism. The loss is realized at the moment of acceptance.

Delegated authority compounds small errors. Agent mandates are scoped by amount, counterparty, and frequency. They are rarely scoped by asset quality. An agent authorized to spend up to a fixed daily amount on cloud compute will faithfully execute that mandate using whichever dollar token its routing logic selects, including one that broke its peg forty minutes ago. Nothing in the mandate is violated. The policy engine returns green.

Add the failure modes that only appear in agentic contexts. Permission scope quietly widening from a one-off action into a standing mandate. Gradual drift, where a sequence of individually reasonable routing decisions carries the agent well outside its principal's original intent. Compromised agents moving funds before a human can intervene. Existing AML and fraud tooling does not see these patterns, because the transactions are authorized, the source addresses are clean, and the behavior does not match classical mule typologies.

Now stack an impaired settlement asset on top of that. The agent is not being attacked. It is doing exactly what it was told, in a currency that stopped being a currency.

The five asset failure modes an agent stack should detect

The first is peg dislocation with persistence. A price deviation on its own is noise. Deviation that persists across venues, deepens on velocity, and is not explained by FX movement in a non-USD peg is a signal. The distinction matters because a monitoring system that fires on every one percent wobble gets muted within a week.

The second is collateral impairment. The peg often holds after the backing has already failed. deUSD traded near a dollar while the collateral behind it was already impaired. Observable conditions include reserve composition shifts, concentration in a single strategy, and exposure to a counterparty that has itself disclosed a loss.

The third is redemption obstruction, meaning whether holders can actually exit at par. Redemption queues, paused withdrawals, and closed redemption windows are among the strongest single predictors of a permanent break, and they are observable onchain before price reflects them. In a rating system this should function as a hard floor override rather than one weighted input among many.

The fourth is liquidity fragmentation. What matters is depth at the venues the agent would actually route through, not aggregate reported liquidity. An asset can look liquid in total while the specific pool an agent's swap path depends on is thin enough that a routine payment moves the price several percent.

The fifth is contamination exposure, meaning whether the asset is structurally connected to something already in distress. The November 2025 cascade moved across three issuers through shared collateral and shared liquidity venues. An asset can be internally sound and still be one hop from a failure.

What a runtime asset check has to look like

An asset check that sits inside an agent payment flow has different constraints than a quarterly risk report.

It has to be fast. The check runs before signature or before settlement confirmation. A latency budget measured in hundreds of milliseconds is the realistic ceiling. Anything slower gets removed from the hot path by the first engineer who profiles the flow.

It has to be continuous. A score computed last week is a historical artifact. The USR window was one hundred thirty-seven minutes wide. Periodic assessment cannot resolve events at that timescale, which is the structural reason traditional ratings agencies cannot serve this use case regardless of methodology quality.

It has to be machine-readable and explainable at the same time. An agent needs a number it can compare against a threshold. The human reviewing the incident afterward needs to know which condition triggered it. A composite score with no traceable sub-conditions produces alerts nobody can act on. A result reading "score 78, redemptions closed at 04:12 UTC" is actionable. A result reading "risk: elevated" is not.

It has to support tiered policy rather than binary blocking, because different actions warrant different thresholds. At low risk, an agent can accept a payment in the asset, hold it across a settlement window, route a swap through it, and keep it in treasury. In the caution band, accepting a payment is still reasonable but the agent should convert on receipt rather than hold, prefer an alternate routing path, and begin reducing treasury exposure. In the warning band, incoming payments should be converted immediately on receipt, the asset should not be held across a settlement window or used as a routing hop, and existing treasury positions should be exited. At critical, the agent declines the asset entirely and exits any position it holds.

The asymmetry is the point. Accepting a token you convert within seconds carries far less exposure than holding the same token overnight. A single blocking threshold forces the operator to choose between over-blocking legitimate payments and under-protecting held balances.

It also has to be delivered where agents already are. For agent-facing infrastructure, that increasingly means an MCP endpoint alongside a REST API, so the check is available as a tool call inside the agent's own reasoning loop rather than as an out-of-band service the integrator has to wire up separately.

Where this fits in the flow

There are three insertion points, in rough order of implementation cost.

The first is pre-acceptance. The agent receives a 402 response naming a token contract. Before signing, it queries the asset score for that contract on that chain. If the score exceeds the configured threshold, the agent either declines, requests an alternate settlement asset, or escalates to a human. This is the cheapest integration and covers the largest share of exposure.

The second is pre-routing. Before a swap or bridge, the agent evaluates every intermediate asset in the path, not just the endpoints. Multi-hop routes regularly pass through assets the operator never explicitly approved.

The third is continuous position monitoring. For any balance held longer than a settlement window, the operator subscribes to threshold-crossing alerts on the assets in the wallet. This is what turns a pre-trade check into a defensive posture, and it is the layer that would have mattered most in both November 2025 and March 2026.

Frequently asked questions

Is this the same as transaction simulation?
‍No. Simulation answers whether a transaction will execute as intended against current contract state. It confirms the transfer moves the tokens it claims to move. It says nothing about whether those tokens are worth what they claim to be worth. Both checks are necessary and they answer different questions.

Does KYT screening cover this?
‍No. KYT evaluates addresses and transaction patterns against sanctions and illicit-finance typologies. A depegging stablecoin has no sanctions nexus and no illicit typology. It is a solvency and structure problem, and it is invisible to compliance screening by design.

Do agents only need this for exotic tokens?
‍The largest fiat-backed stablecoins carry meaningfully lower structural risk than yield-bearing synthetics, and a well-designed scoring system will reflect that with consistently low scores. The check still matters, for two reasons. Agent routing paths pass through assets the operator did not choose, and issuer risk profiles change over time. A check that returns "low risk" in under a second costs almost nothing to run.

Does the GENIUS Act solve this?
‍It raises the floor for issuers inside its scope by requiring high-quality backing and redemption at par, and it creates explicit obligations around continuous risk management. It does not make every dollar-denominated onchain token safe, it does not cover assets outside its perimeter, and it does not give an agent a real-time signal at the moment of payment. Regulatory frameworks set standards. They do not observe conditions.

What about a simple price feed check?
‍Price is a lagging indicator of structural failure and a noisy one. Assets have broken while trading at par because the impairment was in the collateral rather than the market price. Others deviate briefly for reasons that resolve without incident. Price deviation belongs in the model as one input among several, weighted by persistence, velocity, liquidity context, and FX normalization for non-USD pegs.

The shape of the problem

The agentic payments stack was designed by people solving an identity problem. That was the right first problem. An agent has no passport, no legal personhood, and no way to satisfy KYC, so identity and authorization had to be rebuilt from scratch before anything else could work. The industry did that well, and quickly.

The asset layer was skipped because it did not look like a problem. Stablecoins were the stable part. They were the thing that made the rest of the design tractable.

That assumption is now the weakest load-bearing element in the stack. Agents transact faster than humans supervise, settle with finality, and select assets through routing logic that no mandate constrains. The three checks that run today all ask about people and addresses. The fourth check asks about the money, and until it runs by default, every agent payment system is verifying everything except the thing it is actually moving.

Webacy's Digital Asset Ratings provide continuous, explainable risk scores across stablecoins, vaults, and tokenized assets, available via API and MCP for agent-native integration. Every score traces to a specific structural condition.

Sources

• Elixir deUSD, Stream Finance XUSD, and Stables Labs USDX depegs, November 2025: Bitcoin.com News, stablewatch.io
• USR depeg detection timeline, March 22, 2026: Webacy Digital Asset Ratings monitor
• Q2 2026 stablecoin supply contraction: CEX.IO quarterly report, July 2, 2026
• Automated share of stablecoin transaction volume: CEX.IO
• x402 protocol mechanics and adoption figures: x402 specification, Coinbase, Linux Foundation
• Agent identity and mandate architecture: Google AP2, W3C DIDs
• Agent-specific risk typologies (permission inflation, drift, exfiltration): TrustSphere, May 2026
• Stablecoin regulatory framework: GENIUS Act (July 2025), Bank Policy Institute commentary