Agentic payments in 2026: the four layers, and which protocol does what

Most "x402 vs AP2" or "ACP vs UCP" comparisons treat agent payment protocols as rivals. Most of them aren't. They sit at different layers of the same stack, and a real agent purchase usually touches three or four of them at once.

This guide maps every live protocol in the payful.ai registry to the layer it occupies. It also covers what each one does and doesn't do, and where the layers overlap. Every claim links to the protocol's reference page, and each reference page carries its primary sources and a last-verified date.

The four layers

Most confusion goes away once you see that a protocol at one layer doesn't replace a protocol at another. A2A doesn't pay for anything. AP2 doesn't settle anything. x402 doesn't decide whether the user actually wanted the purchase.

Agent communication: A2A and UCP

A2A (Agent2Agent) is an open interoperability layer that lets independent agents find each other, describe their capabilities, and hand off tasks. It carries no money. Payments ride on top of it through other protocols.

UCP (Universal Commerce Protocol) is Google's open standard for the whole shopping journey: discovery, cart, checkout and post-purchase support. Google co-developed it with Shopify, Etsy, Wayfair, Target and Walmart. It is designed to work alongside A2A, AP2 and MCP, and it powers checkout in Google's AI Mode in Search and in Gemini. (The registry still lists UCP as draft while its entry is being verified.)

Payment authorization: AP2 and Visa TAP

This is the layer that answers "did a human actually want this?"

AP2 (Agent Payments Protocol) defines verifiable mandates: signed records of a user's intent and limits. An agent can then transact on the user's behalf, and every step leaves an auditable chain of consent. AP2 works on any payment rail. Google donated it to the FIDO Alliance in April 2026, and v0.2 added Human-Not-Present flows for fully autonomous transactions.

Visa Trusted Agent Protocol (TAP) solves the merchant's half of the problem: is this a legitimate buying agent or a bot? It uses RFC 9421 HTTP Message Signatures, so a Visa-approved agent can prove its identity, the consumer's authorization and its payment credentials. It has been live in Europe with 30+ issuers since July 2026.

AP2 and TAP aren't competitors. AP2 proves the user consented, and TAP proves the agent is who it says it is.

Payment execution: where the real competition is

This layer is the most crowded, and it splits along one fault line: stablecoin-native versus card/existing-rail-native.

x402 brings back the long-dormant HTTP 402 "Payment Required" status code. The flow works like this:

1. The server replies with 402 and machine-readable payment terms.
2. The agent signs a stablecoin payment.
3. A facilitator verifies and settles it on-chain.
4. The agent retries the request with a payment header.

Governance moved to the vendor-neutral x402 Foundation under the Linux Foundation in 2026. Its 40 founding members include Visa, Mastercard, Stripe and Adyen. x402 is the default for pay-per-request APIs and machine-to-machine micropayments.

MPP (Machine Payments Protocol) is co-authored by Stripe and Tempo and runs on both kinds of rail. Card payments go through Shared Payment Tokens, stablecoin payments go through Tempo and Solana, and everything settles through Stripe's existing infrastructure. The spec is open at mpp.dev.

Mastercard Agent Pay for Machines (AP4M) is a network service for high-frequency, low-latency machine-to-machine payments. It builds explicitly on x402 and adds Verifiable Intent credentials, programmable permissions and multi-rail settlement. It launched in June 2026 with 30+ partners, including Stripe, Adyen, Coinbase and Cloudflare, and Early Access opened on October 20, 2026.

ACP (Agentic Commerce Protocol) comes from OpenAI and Stripe. It is built for consumer checkout rather than API calls: a checkout session lifecycle (create, update, complete, cancel) with a human approving the payment. It powers ChatGPT Instant Checkout. (Draft in the registry.)

Two regional protocols prove this isn't only a US/crypto story:

• Pine Labs P3P extends UPI's mandate framework. After one upfront user authorization, an agent can pay with no per-transaction authentication. It is India's first agentic payment protocol on UPI.
• Ant International AMP lets agents pay through existing mobile wallets and super apps. Its global rollout across the Alipay+ ecosystem (10 wallets, 7 acquirers) was announced in September 2026.

Wallet & custody: ERC-4337

ERC-4337 isn't a payment protocol. It is the account-abstraction standard behind programmable smart-contract wallets on Ethereum. For agents it supplies the guardrails: session keys, spending limits and gas abstraction. If an x402 agent holds its own funds, this is usually where its limits are enforced.

How a single agent purchase crosses the stack

Here is a stablecoin-rail example of one agent buying a paid API call on behalf of a user:

1. Communication. The agent finds the service and its capabilities (A2A).
2. Authorization. The user's mandate sets what the agent may spend (AP2), and the agent proves its identity to the merchant (TAP or a similar scheme).
3. Execution. The service returns 402, and the agent pays and settles (x402, or AP4M on Mastercard's network).
4. Custody. The paying wallet enforces the per-session limit (ERC-4337).

None of these steps replaces another, which is why the same companies keep showing up as backers of several protocols.

What to watch

• Atomicity. x402 doesn't guarantee that payment and service delivery succeed or fail together. The research-stage a402 proposal targets exactly that gap.
• "Know Your Agent." Ant International, Mastercard and Visa are collaborating on a KYA interoperability framework. Agent identity is where the next round of standards will happen.
• India. NPCI's Unified Agent Protocol for UPI was expected at Global Fintech Fest in September 2026, but the launch was deferred pending regulatory review.

The full side-by-side, covering rails, settlement, reversibility, human-in-the-loop and D2C/B2B fit, is in the comparison matrix. The weekly changelog tracks what changes.