A thesis with one missing layer

BlackRock’s digital assets team has published The Machine-Native Economy, and its core claim is clean. AI is machine-native intelligence, digital assets are machine-native money, and agents will join the two. I think the thesis is right.

The paper traces three overlaps: tokenization in language models and on ledgers, purpose-built payment rails for agents, and compute as a new asset class. It names the protocols that matter (MCP, A2A, x402, ACP, MPP, AP2, Visa’s TAP) and argues that agents will drive demand for stablecoins and blockspace.

What it never asks is how anyone in that economy proves something without revealing everything. Privacy, confidentiality and zero-knowledge proofs do not appear. Yet the paper keeps arriving at the exact points where proof is needed, and each time it fills them with trust.

The eligibility flag

The paper’s tokenized-fund diagram encodes a transaction as five fields: asset, sender, recipient, units, and an eligibility flag. That last field carries the entire compliance regime. The text explains how it gets there: AML, KYC and know-your-agent checks run off-chain, and only the verified result travels on-chain.

This is how regulated tokenization works today, and it is a sensible starting point. But a flag is an assertion, not evidence. Someone set it, everyone downstream has to trust that someone, and the identity data behind it sits in a database waiting to be breached or subpoenaed.

A zero-knowledge proof replaces the flag with evidence, proving the fact rather than handing over the file. The transaction carries a proof that the holder meets the asset’s rules (accredited, not sanctioned, in a permitted jurisdiction), and the contract verifies it directly. Someone still checks the passport once. The difference is that the check produces a credential the holder keeps, not a flag every counterparty must take on faith.

Mandates that reveal themselves

The paper’s best example is an agent told to book a trip for under $2,500. It pulls the user’s calendar and payment details over MCP, hands fare research to a sub-agent over A2A, pays for rate data per call with x402, and checks out through ACP.

Every step depends on a mandate: who authorized this agent, for what, up to how much, and whether it may delegate. The paper points to Google’s AP2, which uses signed mandates and audit trails as evidence that a user approved the purchase. That is real progress, but an AP2-style mandate proves authorization by presenting it: the budget, the scope, the principal.

Across a chain of delegation, that disclosure compounds. The sub-agent, every paid API and the merchant can each learn more about the principal than they need. The stronger property is a proof that this payment sits inside a valid, properly delegated mandate, with the mandate itself never shown, a cryptographic power of attorney. The hotel needs to know the agent may spend $480 tonight. It does not need to know the trip budget was $2,500.

Trusted by whom?

The paper describes Visa’s Trusted Agent Protocol as a way for merchants to recognize trusted agents, and it lists know-your-agent beside KYC as a compliance check. Both assume an authority that vouches for agents: a network, a registry, a verification provider.

That model works, and it will scale the way card networks scaled. It also places a gatekeeper on the path of every transaction, with a fee and a veto attached. An agent the registry has not heard of is, by default, untrusted.

The alternative is identity the agent carries itself. With self-certifying identifiers, keys whose history anyone can verify without a central registrar, an agent can prove who controls it and what it may do. Add zero-knowledge proofs and it can show attributes such as “operated by a licensed entity” without naming its principal. Trust stops being something rented from an intermediary.

The ledger remembers

In the travel example, the primary agent holds the user’s calendar, email and payment credentials, and the sub-agent pays airline and hotel APIs per call, settled on-chain. Scale that to the always-on, sub-cent volume the paper forecasts. The result is a public, permanent, timestamped record of what every agent looked at and paid for.

The paper reads that activity as demand for blockspace, which it is. It is also a behavioral dataset richer than any card network holds, readable by anyone on a permissionless chain. Fresh addresses help at the margins, but payment graphs are easy to link when the same agent pays the same services every day.

Institutions will feel this first. No asset manager wants its research agents’ data purchases visible to competitors in real time. Private settlement is not a niche preference here; it is a precondition for serious use.

The proof layer

None of this requires replacing the stack the paper describes. MCP and A2A still connect agents; x402, ACP, MPP and AP2 still move money; stablecoins and chains still settle it. What is missing is a layer between communication and payment where three things are proven rather than asserted:

  • Agent identity: who controls this agent and what it may do, proven by the agent itself.
  • Mandate compliance: this action falls inside a valid, properly delegated authorization, without revealing the authorization.
  • Eligibility: this counterparty meets the rules for this asset or payment, without exposing the data behind it.
Diagram of the agent commerce stack in four layers. Communication (MCP and A2A) sits at the top, then a highlighted proof layer made of agent identity (ZKA), mandate compliance (ZKM) and eligibility (ZKC), then payment (x402, ACP, MPP, AP2 and Visa TAP), then settlement (stablecoins, public chains, card and ACH rails). The proof layer is labelled as what the paper leaves out.
Communication, payment and settlement layers as described in BlackRock’s The Machine-Native Economy (2026). The proof layer is the one the paper leaves to trust.

This is the layer we are building at Pyramidal. It takes the form of three open protocols: ZKA for agent identity, ZKM for mandates, and ZKC for compliance. Each is designed to plug into standards the paper’s world already uses, such as permissioned token standards like ERC-3643 for tokenized funds and permission modules for agent smart accounts, rather than ask anyone to migrate. A federated architecture means no single operator sees every proof, every payment, or every principal.

Native money needs native proof

BlackRock is right that machines will need native money. They will also need native proof. When the world’s largest asset manager writes about know-your-agent checks and eligibility flags, the market has accepted that agents must be verified.

The open question is whether that verification runs through trusted intermediaries, as it does today, or through proofs any counterparty can check. The paper calls the ecosystem nascent, and it is. That makes now the moment to choose, because retrofitting privacy into a payment system after it scales has never gone well.

I take each of these layers apart in more depth in the Privacy, Power & Agentic Commerce series.

Disclosure: I am an active contributor to the ZKA/ZKC/ZKM protocol family discussed here, and Pyramidal is building it. These protocols are proposals; this essay argues for the layer, not that any implementation is finished.

Sources