Coinbase formally handed governance of the protocol it built to a vendor-neutral body. The spec itself is chain-agnostic, but real settlement still runs almost entirely through USDC on Coinbase’s Base — meaning the “permissionless” label describes the protocol, not yet the money underneath it.

The number of founding members — including Visa, Mastercard, Stripe, Google, AWS, Circle and Coinbase — now governing the x402 Foundation under the Linux Foundation (PYMNTS, Linux Foundation).

What that number doesn’t say: over the 30 days around the launch, the protocol those 40 companies now steward settled roughly $24 million across 75 million transactions — sub-dollar traffic that’s real but still tiny next to the size of the coalition backing it. The gap between governance scale and transaction scale is worth sitting with, especially set against Bitcoin’s own answer, L402, which shipped its own dedicated site two weeks later with no comparable coalition behind it at all.

Two answers to the same question shipped within two weeks of each other this month, and neither claims to be complete.

The question: what stops an autonomous agent with wallet access from doing exactly what it’s told, even when what it’s told is wrong? Three incidents this year made the failure mode concrete: an NFT that silently expanded a Grok-connected wallet’s permissions, a parsing bug that moved a quarter million dollars in tokens. An agent, at each step, doing exactly what it believed the input told it to do.

Ledger’s answer (included in the News section above), shipped this month, keeps the agent as a proposer and moves the final signature to a device it has no path into. It’s a real constraint: hardware in the loop, physically outside the reasoning surface. But it also reintroduces a step an agentic system exists to remove: something has to be there to press the button.

Bit2’s research this month explores the same problem from underneath. Instead of external hardware or a wallet service deciding case by case, spending policies: rate limits, merchant whitelists, thresholds that require human sign-off live as cryptographically enforceable logic inside the user’s own wallet. No third party holds custody, no hardware step interrupts autonomy; the constraint is written into the funds themselves before the agent ever touches them.

Neither approach eliminates the risk that started this: an agent will still act on a bad instruction. What changes is where the leash sits, and who’s holding it when it snaps. A device in a drawer, a policy written once and enforced automatically, or, still, whoever controls the wallet-as-a-service in between.

The answers aren’t equivalent, and this month’s shipping schedule made the differences concrete rather than theoretical.

A space to slow down, read deeper, and sit with ideas worth more than a scroll.

HTTP has reserved status code 402 for thirty years without a real reason to use it. This piece walks through what changes when Bit2 sits underneath it: a paywall that settles with a zero-knowledge proof instead of a payment processor — no account, no channel kept open, no third party deciding whether the money is real.

It’s a practical companion to the x402 story running through this edition — same protocol most of the industry is standardizing around, but a settlement layer where the receiver never has to trust the rail it’s built on.