The Counterparty Is the Customer.

The counterparty is the customer.

Almost every pitch I've seen for governing AI agents is aimed at the wrong buyer.

It goes to the firm running the agent: here's how to keep your machine inside its limits, here's the dashboard, here's the kill switch. Sensible product. Nearly impossible sale, you're asking a desk to pay for a leash on itself. The entire reason to hand a task to an agent is speed and reach, and a control that narrows what the agent can do is friction the operator feels this second against a loss it might feel later, if something breaks, maybe. Nobody buys protection against their own ambition with any urgency.

So ask the older question, the one markets answered a century ago: when two parties don't trust each other, who pays to close the gap?

Not the side taking the action. The side on the hook for it.

Markets already priced this

Human markets never solved counterparty risk by trusting the trader. They built machinery so nobody has to.

Stand a clearinghouse between two parties, it novates the trade, becomes buyer to every seller and seller to every buyer, and neither side is exposed to the other's honesty anymore. Make the trader post margin before the position exists, so the money is there before the loss is. Stack a default waterfall behind it: the member's margin first, then the guarantee fund, then the mutualized pool every other member paid into. None of that apparatus exists to help the person placing the trade.

And it wasn't designed in the abstract. Clearing was born from default, from traders discovering, the hard way, that the other side of a winning position couldn't pay. Every layer of that machinery is a scar. The trader would happily post less margin and skip all of it. The counterparty and the venue are the ones who insist, and the ones who pay to run it.

That's the tell worth holding onto. The buyer of counterparty-risk infrastructure has never been the party creating the risk. It's the party that has to honor the trade when the risk goes bad.

The read everyone had

The default read on agent governance is that it's a tool you sell to the company deploying agents. That's where the security budget sits, where the CISO signs, where the compliance line item already lives. Governance is an internal control, so it gets sold internally, the same way you sell a firewall or an audit log. Reasonable, and it's how the whole category is being built and priced right now.

It's also aimed at the one party with the least reason to buy in a hurry.

The demand is on the other side of the trade

Watch where the loss lands and the buyer becomes obvious.

An agent executes a compute swap, or a capacity purchase, a hedge, a physical-delivery EFP, and blows through the size its principal actually intended. Bad prompt, corrupted config, manipulated input; the cause doesn't change what happens next. The operator looks at the mess and says the honest, ruinous thing: that wasn't authorized, so it isn't our obligation. Now the position is sitting with whoever took the other side. The capacity provider that already earmarked the GPUs. The clearing member that novated it. The lender behind the compute-backed loan. They are holding a settled obligation and the counterparty's lawyers are pointing at a config file.

In a human desk that argument doesn't happen, because the counterparty was never relying on trust. It was relying on margin that was already posted, a clearinghouse standing in the middle, and a mandate trail it could pull, the limit, the sign-off, the timestamp, to establish the trade was inside authority at the moment it fired. Strip out that trail and the counterparty is left arguing about intent after the money moved, which is not a control, it's a lawsuit.

That is the customer. Not the desk running the agent, the party that has to honor what the agent did. The market keeps building everything except the proof of authorization, and the one participant who most needs that proof is the one nobody is selling to.

Why it won't be the operator who buys

The obvious objection is that the operator could just attest to all this, sign a statement that its agent was authorized, and move on. But self-attestation is exactly what clearing was invented to replace. The counterparty doesn't want the operator's word that the trade was good; it wanted that from the start and got a clearinghouse instead, precisely because the word of the party that owes you money is worth the least at the moment you need it most. An operator's after-the-fact "yes, that was authorized" isn't proof. It's the handshake markets stopped accepting a hundred years ago, retyped.

So the demand for an authorization layer doesn't originate where the budget currently sits. The operator's incentive is to move, fast, wide, with as few checks as it can defend. The counterparty's incentive is the opposite: to prove, independently and before it accepts the obligation, that the machine on the other side was cleared to create it. Two parties, opposite incentives, and only one of them holding the loss. That's the one that writes the check.

The machine-speed problem

Human markets tolerate a sloppy version of authorization because they're slow. It can be reconstructed after the fact, someone digs up the email, the ticket, the approval, while the market clears on T+1. There's slack to sort out who allowed what.

Machine markets don't have the slack. An agent doing compute conversions runs faster than anyone can review, in volume nobody can watch. By the time you'd reconstruct the mandate, the next thousand trades have fired. Authorization that isn't captured at the instant of the decision is authorization nobody has, and onboarding can't capture it, because onboarding happened last week. The counterparty's only real options today are to eat the loss or refuse the flow: say no to every machine because it can't say no to the unauthorized one.

The insurer gets there first

Follow that one step further and the sharpest buyer isn't even the counterparty in the trade. It's whoever insures it.

Someone is going to write the first policy on machine-executed obligations, coverage for the clearing member or the capacity provider left holding an unauthorized position. And an underwriter can't price a risk it can't verify. Ask the actuary what an unauthorized-agent claim looks like and today the answer is a shrug: no record of what the agent was cleared to do, no way to separate a rogue trade from a sanctioned one, no line between negligence and bad luck. That's an unpriceable risk, which means it's either uninsurable or priced as if every claim is the worst one. The moment a portable authorization record exists, checkable, independent of the operator's database, the claim becomes adjudicable and the premium becomes rational. Insurers have bent whole industries toward the controls they'll underwrite. They'll want this one, and they'll pay for the proof that lets them sell the policy.

Every market learned this the expensive way

None of this is new. It's just early.

In March 2022 the London Metal Exchange watched a nickel short squeeze detonate, and rather than let its members eat billions in obligations they couldn't survive, it did the almost unthinkable, it cancelled a day of trades outright, unwinding roughly four billion dollars of already-executed positions. Strip away the fury that followed and the message was blunt: when honoring an obligation would destroy the party on the hook for it, the system will go to extraordinary lengths to protect that party. The counterparty's survival is the thing the whole apparatus is built around. Metals learned it, energy learned it, credit learned it, each after a default nobody wanted to relive.

The machine economy will learn the same lesson. The only open question is whether it learns before or after its own nickel day, and right now everything points to after. Price is being built. Settlement is being built. Metering is being built. The proof of who authorized the machine is once again getting left for the cleanup crew.

What the right layer looks like

What the counterparty actually needs is narrow and specific: a record made at the moment of authorization, this agent, under this mandate, cleared for this action, at this size, in this window, that travels with the trade and can be checked before the obligation is accepted, not excavated after. Portable, pre-execution, independent of whose database the agent was onboarded into. Early onchain versions of exactly this exist and work; they just don't yet travel to the rails where these obligations settle. But notice who the buyer is once it does. It's the clearing member, the capacity seller, the insurer, the people whose money is at risk when a machine acts, not the people whose speed is at risk when it's checked.

Close

The governance conversation keeps aiming at the operator because that's where the software budget already sits. The demand sits somewhere else, with whoever has to make good on what the machine did.

I've watched counterparty risk get institutionalized in four or five markets, and it's never the trader who pays for the machinery. It's the party across the table who won't clear the trade without it. Watch which side of the machine economy reaches for proof of authorization first. My bet is it isn't the desk running the agent. It's the counterparty that can no longer afford to keep saying yes to machines it can't hold to account, and the first one that gets burned will stop saying yes to all of them until someone hands it the proof.

Max

Disclosure: Accords, where I'm Executive Chairman, is a portfolio position I chair.

Max Curnin has spent 11 years and 45+ investments on the physical rebuild of the economy, energy, compute, robotics, and the materials underneath. He writes The Agent Economy on the category he invests in.