The trust inversion

The year the infrastructure arrived: The forecast, corrected

A year on, the claim I could not yet prove looks less like a forecast and more like a description, though not quite in the way I expected. 

Last year, in an essay for the Kyndryl Institute, I closed with a line I believed but could not yet prove: the agentic era of financial services was here, and the time to act was now. 

In September 2025 I described a “Do It For Me” economy in the future tense: consumers delegating to AI proxies that shop, switch and settle on their behalf. Less than a year later, that economy no longer looks theoretical. By the spring of 2026, agent-initiated commerce had moved from demonstration into pilots, beta launches and early production integrations. Visa and Mastercard were building dedicated agentic payment infrastructure: tokenisation, authentication and spending controls designed for a machine acting on a customer's behalf. OpenAI had introduced checkout inside ChatGPT, while keeping acceptance, payment processing, fulfilment and customer support with merchant backends. Amazon was testing a feature that completes purchases from other brands' sites on a customer's instruction. The networks' own language now treats checkout as something agents will increasingly initiate, not merely assist.

It would be easy to file this under retail payments. That would be a mistake. The same architecture that lets an agent buy a suitcase can let it move money, switch products, triage a complaint, manage a credit line, execute a trade or assemble compliance evidence. Commerce is simply where the rails were laid first, because that is where the demand and the revenue were clearest. Financial services is where the consequences land hardest.

So the headline I might have written a year ago (autonomy is coming) needs one important correction. Full autonomy has not arrived everywhere; across most of finance it has barely begun. What arrived is the infrastructure for autonomy: identity, payment authority, tool access, the ability to initiate a transaction. And it arrived before the agents using it had earned broad trust. That is the trust inversion: the rails of delegation are being built faster than the reliability of the things we are delegating to.

The architecture of delegation: Identity is necessary; permission is the point

Strip away the novelty and the problem is an old one. Economists call it the principal-agent problem: how does a principal get an agent to act in the principal's interest, when the agent has its own latitude and the principal cannot watch every move? For a century, the discipline of delegation has rested on three things; human finance encodes them in contracts, fiduciary duty, supervision and, ultimately, the courts.

Software agents arrive with no license, no fiduciary duty, no fear of being struck off. The entire burden of mandate, monitoring and recourse therefore falls on the technical architecture instead. That is why identity matters, and also why identity, on its own, is not enough.

Identity answers one question: who acted? It is necessary; without it, accountability has nowhere to attach. But the question a regulator will press harder is the next one: what were they allowed to do? Identity without permission is a name without a leash. Permissions answer the questions that actually decide whether a delegation was safe, and they are the questions firms should be designing for now.

This is why the quiet contest over standards matters more than any model release. The protocol that connects agents to tools and data (Anthropic's Model Context Protocol, donated to the Linux Foundation's Agentic AI Foundation in December 2025) has become one of the foundational pieces of plumbing. But it is only one layer. The harder, more fragmented landscape is forming around payments and authorization, where competing schemes are still being fought over: the Trusted Agent Protocol, the Agentic Commerce Protocol, Google's Agent Payments Protocol, the Machine Payments Protocol and the Universal Commerce Protocol. Whoever sets those standards is, in effect, designing the accountability chain: deciding whether every agentic action can be traced back to an authorizing human, or whether responsibility dissolves into the gaps between systems. That is a public-interest question being settled, for now, largely by private firms. Regulators need not write the protocols. But we cannot be absent from the room in which they are written.

The UK's actual edge: Proximity is not a thicker rule book 
It was never likely that the UK would win this era by writing the longest rulebook. The UK confirmed in 2025 that it would not create bespoke AI legislation, governing instead through the principles already in place: the Consumer Duty, the Senior Managers regime, outcomes over instructions. I defended that choice then and I defend it now. A rulebook written for today's agents would be obsolete before the ink dried, and the agents of 2027 will be different again.

But “no new law” was never the same as “no plan.” Our edge is not regulatory restraint; it is regulatory proximity: being the jurisdiction where agents are tested, in the open, before they are trusted at scale. The year's lesson is that this was the right bet, because the binding problems turned out to be reliability, accountability and controlled delegation, and none of those is solved by statute. They are solved by evidence: by watching agents fail safely, learning what good looks like, and codifying it into expectations firms can actually meet.

The next phase: Closing the inversion

If the last year was about recognizing the inversion, the next is about closing it. That work is concrete, and it is mostly not about building cleverer models.

01 Build the accountability stack before the volume arrives
Mandate, permissions, audit, revocation, liability and redress should be designed in now, while agentic finance is still in pilots, not retrofitted after the first scandal. The cheapest moment to require a kill switch is before anything needs killing.

02 Treat correlation as a first-class risk
If the system is going to lean on a few models and a few providers, then concentration, common-mode failure and agent herding belong inside stress tests and the critical-third-parties regime, not in a footnote. Diversity of models and suppliers may need to be encouraged as a stability property, rather than left to procurement.

03 Make the standards a public-interest project 
The protocols for agent identity, permission and payment are being set this year. The UK should be an active voice in shaping them toward traceable accountability, and should be willing to say plainly that an agent which cannot prove its mandate has no business initiating a regulated transaction.

04 Coordinate across borders, because agents will not respect them
An agent authorized in one jurisdiction will transact in another within the same second. Without interoperable identity and shared supervisory expectations, we will reproduce (at machine speed) every gap and arbitrage that fragmented regulation has always created. Through GFIN and its peers, cross-border coordination on agentic finance is not a nicety. It is infrastructure.

A year ago I wrote that agentic AI was here and the time to act was now. The infrastructure for autonomy has indeed arrived, and we did begin to act. The task of the coming year is to make these agents worthy of the trust we are already, quietly, every day, beginning to place in them.