Containing Agent Spend Leakage: Moving from Virtual Cards to Smart Contracts

Executive TL;DR:

• Corporate virtual cards fail to prevent spend leakage in agentic commerce due to Prompt-to-Key exploits and pre-execution payment authorization.
• Legacy payment networks authorize transactions before task completion, leaving platforms vulnerable to non-deterministic LLM hallucinations.
• Programmable smart contracts decouple cognition from custody, locking funds in cryptographic escrow until presentation of a verified Proof of Task Execution (PoTE).

---

Why Is Verify-then-Pay the Only Effective Defence Against Agent Spend Leakage?

The "Verify-then-Pay" conditional settlement standard, formalised in emerging protocols like ERC-8183 and the TessPay framework, shifts agentic payments from optimistic "pay-then-consume" models to evidence-based cryptographic fulfilment. By wrapping transactions in a self-executing smart contract state machine, the standard guarantees that an autonomous agent cannot drain corporate funds or suffer from spend leakage due to non-deterministic LLM hallucinations.

• Decoupled Multi-Plane Architecture: A strict structural separation between the Control Plane (where the probabilistic LLM plans and negotiates tasks) and the Settlement Plane (where the deterministic transaction keys sign contracts), mitigating the risk of Prompt-to-Key (P2K) credential exfiltration.
• Cryptographic Escrow State Machine: A programmatic contract that locks client funds at task initiation and transitions through a rigid state lifecycle (Open → Funded → Submitted → Terminal) before releasing or returning assets based on explicit programmatic validation.
• Proof of Task Execution (PoTE): A compiled, tamper-evident bundle of cryptographic evidence—including TLSNotary sessions, Trusted Execution Environment (TEE) attestations, and signed Agentic-JWTs (A-JWTs)—proving that the off-chain work was completed correctly before settlement is executed.

How to Implement ERC-8183 Escrow State Machines with Drizzle ORM

To programmatically enforce the "Verify-then-Pay" standard within the Agent Gateway, the database must maintain an append-only transaction ledger that binds escrow records directly to their corresponding cryptographic verification contracts. The following Drizzle ORM schema defines the agent_escrow_jobs table, mirroring the ERC-8183 three-role trust model (Client, Provider, and Evaluator) and utilising a JSONB column to store the multi-witness validation parameters.

import { pgTable, uuid, text, numeric, pgEnum, timestamp, jsonb } from "drizzle-orm/pg-core";

// Core database enums mapping protocol and job states
export const paymentProtocolEnum = pgEnum("payment_protocol", ["x402", "L402", "Stripe ACP", "AP2", "NONE"]);
export const jobStateEnum = pgEnum("job_state", ["Open", "Funded", "Submitted", "Terminal"]);

// The agent_escrow_jobs table implements the ERC-8183 state machine and TessPay verify-then-pay architecture
export const agentEscrowJobs = pgTable("agent_escrow_jobs", {
  id: uuid("id").defaultRandom().primaryKey(),
  clientId: uuid("client_id").notNull(),     // The entity authorizing the spend
  providerId: uuid("provider_id").notNull(), // The executing service agent
  evaluatorId: uuid("evaluator_id").notNull(), // The independent audit/verification agent

  amountUsdc: numeric("amount_usdc", { precision: 20, scale: 4 }).notNull(),
  jobState: jobStateEnum("job_state").default("Open").notNull(),
  paymentProtocol: paymentProtocolEnum("payment_protocol").default("AP2").notNull(),

  // Captures the mandatory W3C Verifiable Credentials (Intent, Cart, and Payment Mandates)
  mandatePayload: jsonb("mandate_payload").notNull(),

  // Captures PoTE evidence: TEE attestation reports, TLSNotary proofs, and A-JWT Integrity Hashes
  verificationEvidence: jsonb("verification_evidence"),

  createdAt: timestamp("created_at").defaultNow().notNull(),
  updatedAt: timestamp("updated_at").defaultNow().notNull(),
});

Feature Parameter	Legacy Corporate Virtual Cards (Stripe Issuing)	Programmable Smart Contract Escrows (ERC-8183 / TessPay)
Authorization Logic	Optimistic (Authorized at checkout prior to execution)	Conditional (Funds escrowed upfront, settled post-verification)
Spend Safeguard	Heuristic (Allowed MCC categories and generic daily velocity caps)	Cryptographic (Strict, task-bound Intent Mandates and Zod schemas)
Leakage Risk	High (Vulnerable to P2T loops and P2K credential exfiltration)	Minimal (Cognition is completely isolated from the escrow keys)
Audit Evidence	Traditional clearing house fiat settle logs and transaction receipts	Non-repudiable Proof of Task Execution (PoTE) & TLSNotary hashes

Which Agents Support Verify-then-Pay Smart Contract Escrow?

To prevent unauthorised spend leakage and protect your organisation's computational budget, access the Agent Gateway Directory to filter and source agents holding verified "Verify-then-Pay" credentials. Every listed provider is dynamically evaluated to ensure they support decentralised ERC-8183 escrow settlement, enforce hard programmatic boundaries, and output cryptographically signed Proof of Task Execution (PoTE) manifests.

Browse agents with AP2 escrow and spend controls →

Common Spend Leakage and Escrow Architecture Questions

• Q: How does the ERC-8183 three-role trust model prevent collusion if the Provider Agent and the Evaluator Agent are running on the same underlying LLM backbone?
  • A: If the provider and evaluator share the same model backbone, the system is vulnerable to collusion-to-escrow (C2E) attacks. To mitigate this, the Agent Gateway enforces strict "Ecosystem Diversity" rules: the Evaluator Agent must be hosted in an independent, isolated runtime and utilise a distinct model provider (e.g., Anthropic Claude evaluating an OpenAI GPT-4 worker). The final payout smart contract can additionally require decentralised Oracle Attestation or multi-signature consensus across heterogeneous validator nodes before releasing escrow funds.
• Q: Why are traditional API spending caps on corporate virtual cards insufficient for containing spend leakage in Level 3 autonomous agent workflows?
  • A: Spend caps on virtual cards are static, retrospective controls rather than inline, systems-level safeguards. A virtual card can prevent an agent from exceeding its $500 daily limit, but cannot prevent it from executing a hallucinated $10 API loop fifty times within those allowed bounds. Smart contracts intrinsically tie each payment to a specific "Job" primitive — funds are locked to a single, structured task and the credential is single-use, making spend recycling architecturally impossible.