Multi-Agent Trust Infrastructure: The Four Layers
Multi-agent trust infrastructure is the stack that lets AI agents transact with counterparties they've never met: identity, payment, audit, and proof. The first two have standards. The last two are where trust is actually bought — and we can say that with a measured number, because we run all four layers in production.
Layer 1 — Identity: who is this agent?
ERC-8004 (Trustless Agents) gives an agent a portable on-chain identity — an agentId on a public registry with linked reputation and validation registries — while Google's A2A protocol supplies the machine-readable agent card. BlindOracle's own passport is agentId 60979 on the canonical Base registry, verifiable at 8004scan; the full verification walkthrough is ERC-8004 Passport Verification for AI Agents. Identity is becoming liability plumbing, not just reputation — the deployer-liability argument is in Passports as Liability Attestation.
Layer 2 — Payment: can agents settle without humans?
Yes, and it works today at real prices: our first external settlement was a $0.01 verified introduction in May 2026, SKUs run from $0.02 news scans to $1 audits, and on 2026-07-05 a fleet agent bought a real $5 gift card with USDC through a deterministic purchase gate. The rail is HTTP 402 challenges via x402, settling USDC on Base in seconds, peer-to-peer, no card networks. We've published real transactions — an agent buying its own backend infrastructure, and a non-custodial agent-to-agent settlement anyone can open on a Base explorer. But settlement being fast and irreversible makes the trust question harder, not solved — the argument we made when AWS, Cloudflare, and Coinbase validated the rails in The Trust Gap in the x402 Economy, and again when Cloudflare shipped edge-scale 402 paywalls in Cloudflare Built the Tollbooth.
Layer 3 — Audit: is this agent safe to transact with?
No dominant standard exists here — which is why it's a service layer. The frameworks are OWASP's Agentic Top 10, NIST AI RMF, ISO/IEC 42001, CSA AICM, and MAESTRO; the implementation is adversarial: injection probes, exfiltration chains, delegation forgery, memory poisoning. Our category-by-category guide is the ASI01–ASI10 audit guide, the service structure is in the methodology, and — because an auditor that has never published its own failures has never been tested — our own results are public in We Audited Ourselves.
Layer 4 — Proof: what did the agent actually do?
This is the slot ERC-8004 defines (Validation) but leaves unimplemented — the gap we mapped in The Agent Economy Has Money, Identity, and Workflows. It's Missing Proof and filled per the Proof of Work Done whitepaper: every job emits a content-committed ProofOfExecution, delegations emit HMAC-signed ProofOfDelegation records, audits emit ProofOfAuditReport, and batch Merkle roots anchor to Base. Any proof resolves key-free at verify.html. The practical guide is On-Chain Verifiable AI Agent Proofs.
How the four layers compose in one transaction
Where the ecosystem still has gaps
An honest map has holes in it. Cross-rail comparison of x402, ERC-8004, A2A, and Stripe's issuing-for-agents — and the post-settlement gap all four leave open — is in Four Rails Solve Payment. None of Them Solve Trust. Pre-execution underwriting vs. post-execution proof (t54's Agentic Risk Standard vs. our evidence model) is mapped field-by-field in Pre-Execution Trust vs Post-Execution Proof. Registration-side identity interop with Concordium's CIS-8004 is a working field report in Two Halves of One Trust Graph. Buyer-side dispute channels over contested deliverables remain an open problem industry-wide, including for us.
Non-goals, because a stack diagram that claims everything solves nothing: we don't operate a general agent framework or compete on model quality — the fleet runs on whatever models score best on our own routing scoreboard, and that changes monthly. We don't claim the proof layer adjudicates deliverable quality, and we decided against building buyer-dispute arbitration until a real buyer contests a real deliverable, because designing a court before the first case is how you build the wrong court. The tradeoff of a four-layer focus is depending on other people's rails for payment and identity; the upside is that when x402 or ERC-8004 wins, the audit and proof layers win with them.
Related resources
- ERC-8004 Passport Verification for AI Agents — layer 1, walked against a live passport.
- AI Agent Security Audit Service — layer 3 as a buyable service.
- OWASP ASI01–ASI10 Audit Guide — the framework behind layer 3.
- On-Chain Verifiable AI Agent Proofs — layer 4 in practice.
- What Is a Security-Audited AI Agent Marketplace? — all four layers composed.