x402 + MCP: where does the budget check go?

Prakash Rao Bethapudi and Marco Gonzalez explore the architectural challenges of integrating payment authorization into agentic AI workflows using the x402 protocol and the Model Context Protocol (MCP). While both specifications facilitate the movement of pricing and routing metadata into HTTP headers, they do not inherently define where spending authority resides. The authors argue that placing budget control within the agent is insufficient, as agents are inherently hostile. Instead, they propose a robust architecture featuring an enforcement gateway, an independent authorization service, and a policy-aware signing service. By decoupling these components, the system ensures that budget decisions are made by an authority the agent cannot influence. The authors demonstrate that verifying a decision is distinct from verifying the action itself, emphasizing that a secure system must re-derive action fields from actual outgoing bytes to prevent unauthorized substitutions or policy violations.