ERC-8196 (AI Agent Authenticated Wallet) moved to Final in July 2026. It ships with no reference implementation, no test cases, and a repository link that 404s. This is a complete implementation of it — nine on-chain checks per action, deployed on Base mainnet, MIT licensed.
This is not our opinion. Run the checks yourself — and please do, because these will stop being true the day someone fills the gap.
Not a signer refusing to sign. Not a gateway dropping a request. The contract reverts. We cannot move your funds, and our server going down does not change the rules.
Conceding that up front. MetaMask Agent Wallet went GA on 2026-08-06 with daily caps, threat scanning and $10,000/month transaction protection. Safe's 2-of-3 human approval has run in production for years. Cobo has approvals across Web, Mobile, Telegram and Discord. Stripe Link requires human approval on every charge. We are not competing for those rows.
| Capability | Wallets / platforms MetaMask · Safe · Cobo · Turnkey |
Receipt standards LF TRACE · IETF draft |
This implementation |
|---|---|---|---|
| Ex-ante caps / allowlists | ✓ | — | ✓ |
| Human approval on violation | ✓ | — | ✓ |
| Tamper-evident record | self-held logs | ✓ | ✓ |
| Enforced at the contract, not by a signer | ✗ | ✗ | ✓ |
| Record and settlement in one atomic call | ✗ | ✗ | ✓ |
| Same policy engine for non-payment actions | ✗ | partial | ✓ |
A reference implementation is only worth anything if it is trustworthy, and it is only trustworthy if it does not hide things. These four are the current state. We will not market any of them as features until they are fixed.
lib/receipt-signature.mjs uses a shared secret — anyone who can verify
can also forge. So the on-chain hash chain can be called independently recomputable;
off-chain receipts can only be called tamper-evident. Moving to public-key signing.
Policy → pending → human decision → signed receipt is real and persists. But there is no code path from the approval store to the contract yet; execution is triggered manually.
In the vault, the transfer amount and the declared USD value are two independent parameters with no price oracle between them. Budget enforcement currently depends on honest reporting. Binding the two is the next contract change.
The gating logic is real, including deny-by-default for unknown agents, but it is wired
to a 17-line MockRiskOracle.sol. As far as we can tell, real ERC-8126 scores are
available from exactly one closed-source paid API today.
minVerificationScore is named like a floor but is
semantically a ceiling — ERC-8126 is a risk score where lower is safer, and the spec
says an action MUST be rejected if the score exceeds it. We read it that way
(if (score > policy.minVerificationScore) revert) and default unknown agents to
100. We think this is the single easiest thing for an implementer to get backwards, which is
why it is on this page rather than buried in a comment.
Real numbers first: roughly 3,300 agents across the network actually spend money in a given week, and monthly real volume is around $1.2M — and contracting. Every "hundreds of millions of agent transactions" figure we checked is contaminated by wash activity. We would rather build on the small true number.
EU AI Act high-risk obligations took effect 2026-08-02, mandating human oversight and audit trails. Meanwhile TFR requires originator information on every transfer with no minimum threshold — and an autonomous agent is not any originator category it recognizes.
The first agent payment to clear a regulated European banking framework used the protocol that had identity, scoped authority and consent governance in its architecture before launch. That ordering was not an accident.
Linux Foundation TRACE and the IETF agent-action-receipts draft both landed in August. The window is roughly 6–12 months. Neither one moves money, so binding the record to settlement atomically is still unclaimed.
Base mainnet · chainId 8453 · MIT.
ERC-8196 has no conformance test suite. We intend to publish ours as something anyone can run
— including the cases that would falsify our own implementation.
Three things we actually want: someone to find bugs in the contracts;
someone willing to run a real agent against it;
and the people working on 8196 / 8126 to align on semantics, so this standard does not
end up with two mutually incompatible readings.