AI agents need four on-chain primitives to transact tokenized assets — identity, reputation, a bounded mandate, and settlement — enforced inside the token’s compliance hook (ERC-7943). But authority is not truth: they also need a verified, machine-readable record to reason over.
Autonomous agents that spend, sign, and negotiate on behalf of a principal cannot authenticate like SaaS software. The emerging on-chain stack answers who the agent is and what it may do — but not whether what it believes is correct, which is the part that decides whether an autonomous action on a regulated asset is safe.
The four authority primitives
A credible framing — advanced by Brickken and others building on Ethereum standards — puts four primitives on-chain so an agent’s authority is fully accountable:
- Identity — a verifiable, resolvable identity for the agent (e.g. the draft ERC-8004 trustless-agents interface), so it is a first-class on-chain actor rather than a row in a vendor’s database.
- Reputation — an immutable, attributable feedback trail downstream systems can read without trusting an aggregator.
- Mandate — a scoped, time-bounded, value-capped grant of authority from a KYC-verified principal: effectively an on-chain power of attorney (the draft ERC-8226 / Regulated Agent Mandate Standard aims to standardize this).
- Payment — a cryptographically attributable settlement method (e.g. x402 signature-based, pay-per-request stablecoin transfers) that replaces the shared API key.
All four ultimately enforce inside the pre-transfer compliance hook of the token standard — ERC-7943 (uRWA) or ERC-3643. The regulated token checks eligibility, and in mandate designs the agent’s scope and caps, atomically at transfer time. This is why the token-compliance substrate matters as much as the agent layer above it.
The fifth primitive: verified context
The four primitives govern authority. None of them establishes truth. An agent with a flawless mandate — correct scope, caps, jurisdiction, and validity window — will still execute a wrong action if the record it reasoned over was stale, unstructured, or ungoverned. Every primitive did its job; the outcome is still incorrect, now with a transaction hash attached.
This is the dominant failure mode of enterprise AI in general: pilots fail on data readiness, not model quality, and agents make it worse because they reason across multiple steps without a human catching each error. On a regulated asset — where the cap table, valuation basis, offering terms, and investor eligibility all have to be right — the missing primitive is a verified, machine-readable record the agent can trust before it acts.
The edge cases
A mandate is not diligence. Scope and value caps bound how much an agent can do, not whether it should. The “should” depends entirely on the correctness of the underlying record, which lives above the mandate, not inside it.
Read before transact. The safe sequence is: read verified truth first, transact under a bounded mandate second. An agent that queries a verified knowledge layer before acting is performing automated due diligence against a record it did not have to trust blindly. Stobox Intelligence builds exactly that record — a company organized into one canonical, verifiable, machine-readable form — and Stobox operates it as a live endpoint AI systems can query.
The substrate is shared. ERC-7943 was authored by Brickken’s Dario Lo Buglio; Stobox is a backer and issues on it in production via Compass. The agent-mandate standards sit on top of that shared substrate, so the interesting differentiation is not the rails — it is the verified context on one side of the mandate and live, compliant issuance on the other.
Gene Deyev’s take
Everyone racing to give agents identity, reputation, mandates, and payments is solving the authority problem, and they are right to — better models do not fix institutional accountability. But an agent with perfect authority and a stale record is a liability that clears audit right up until someone checks whether it was correct. The scarce input is verified context: the machine-readable record the agent reasons over. That is the layer we have shipped. Read verified truth first, transact under a bounded mandate second — both halves have to exist.
— Gene Deyev, Founder & CEO, Stobox. Author of the Stobox Tokenization Framework; ERC-7943 backer; SEC Crypto Task Force roundtable participant (2025).
Related questions
- What is ERC-7943 (uRWA)? — the compliance hook where agent mandates enforce.
- ERC-3643 vs ERC-7943 — the two substrates an agent mandate plugs into.
- How do you handle forced transfers and lost keys on a security token? — the enforcement powers a mandate operates within.
Last updated: 2026-07-21.