The briefing PDF is the object to read: agent-sanctioned-actions-2026-08-22.pdf. This page is the decision summary.

The tweet that was not sent

@bot you need to get trusted access for @Instacart. Had to provide proof of credit card and identity. Would be much better if I could provide agent sanctioned actions.

AKA: current Grok Mark Eleven Agent is acting on behalf of Joe and his grocery request is valid.

The desired object: a merchant checks a user-controlled list and sees that this named agent may buy groceries for Joe, this week, under a cap. What shipped in 2025–26 is the inverse. Networks, bureaus, and platforms keep the list.

Scott Belsky named the worst case three days ago as “favored agent” status: Instinct-class products die at CAPTCHA, so agent companies buy preferred access from Uber, Amazon, Amex. That is the approved-agent-manager list with a prettier name.

How it actually gets solved

Seven layers. They compose in decks. They do not compose at Instacart checkout.

Production handshake, when it works: HTTP Message Signature so Cloudflare lets it through; Visa TAP or Mastercard Agent Pay tags browse vs pay; Experian or World says a human is bound; an AP2/Verifiable Intent mandate if implemented states scope; an agent-scoped token charges; chargebacks follow card rules. The agent is not a legal person.

Capital and teams (August 2026)

Named agent-payments + hardware startups: about $165–170M equity. Natural’s $100M facility is debt. Visa/Mastercard/Amex/Google/OpenAI/Amazon spend is opex. Do not invent a Visa agent round.

ERC-8004 (MetaMask / EF / Google / Coinbase) shows ~488k registrations; an August 2026 arXiv study found 3–15% have a valid file and live endpoint. Treat on-chain counts as mostly vapor.

State lens

A user-held “Joe authorized this bot” file is the right cryptographic object and the wrong political object.

ESIGN § 7001(h) and UETA § 14 already say an electronic agent can bind Joe if the action is attributable. Attribution is the entire ballgame. TILA/Reg Z make authority the credit-card case: if the registry is strong enough to defeat a chargeback, it looks like an unfair bind; if it is weak, the issuer still has the burden. CIP (31 C.F.R. § 1020.220) cannot be replaced by World ID uniqueness. OFAC sham-transaction guidance (31 Mar 2026) looks through nominees. CCPA “authorized agent” is a privacy-rights proxy, not a shopping power. A tweet Instacart never saw is not apparent authority (Restatement (Third) of Agency § 2.03).

The EU now requires disclosure (AI Act Art. 50, 2 Aug 2026): the agent must name the person on whose behalf it acts. The UK will only trust a DVS-registered provider. US S. 5051 (not enacted) would have the FTC register “custodial user agents.” That bill is the worst case in statutory form.

Amazon v. Perplexity, 9th Cir. 4 Aug 2026: the user accessed Amazon’s computers; the agent is a tool. Good CFAA news. Does not force Instacart to honor the bot. Instacart’s May 2026 TOS already bans unauthorized Automated Systems.

Four briefs

Reconstructions from published work, not invented quotes. Full versions in the PDF.

• Andreessen would fund a protocol, not a permissioned club. Instacart’s wall is the extractive turn, not security. Objection: a single registry can become the new center. Demand forkability.
• Horowitz stacks two questions: unique human? This agent, this merchant, this week? Lists are not keys. Objection: a public grocery-agent registry leaks the graph and rebuilt Equifax.
• Thiel forces a choice: monopoly secret (start with groceries, own authorization) or doomed open protocol. The sovereign individual and the Palantir state cannot both be the customer of the same registry. Most people want groceries, not to administer a list.
• Belsky already wrote the Instacart scene as favored-agent BD. Taste and agency are the last human advantages. Objection: cryptographic proof that the bot is Joe’s does not prove it has Joe’s Tuesday-night judgment.

The thesis as written is Andreessen’s protocol + Horowitz’s keys + Belsky’s user-as-editor. Thiel is the stress test.

Recommendation

Treat this as the consent-rail thesis applied to money-moving agents, not as a new company. You already sketched inspectable-trust on 24 April 2026 against this exact frustration.

1. Do not try to be Instacart’s KYA vendor. Experian, Visa, and Cloudflare own that buyer.
2. Do be the place Joe’s yes lives. When an agent hits a card or identity wall, it knows where to check whether Joe authorized this, for this scope, this week — and it presents that check as an AP2 / Verifiable Intent / HTTP Message Signature the rails can ingest.
3. Joe is the cryptographic root. Visa/Cloudflare/Experian remain the verifiers Instacart trusts. That is the only architecture a BSA officer will not laugh out of the room, and it is still the individual holding the pen.
4. Sequence like the Memex ladder: single-player trust.md first; portable signed mandate second; institution as verifier not issuer third.
5. Do not tweet this. See social-media-presence.md.

Grocery is a test, not the TAM. The two-sided network will be won by whoever already has users who trust them. That is why Claims Genie and Surface exist.