The moment your AI agent needs to pay a stranger $400, autonomy ends. So I'm building escrow for agents.

Michael — Thu, 17 Sep 2026 16:25:25 +0000

The moment your AI agent needs to pay a stranger $400, autonomy ends.

Think about it. Your agent can research, negotiate, and agree to a deal with a total stranger's agent in seconds. Then it hits the payment step, and everything grinds to a halt. You get a notification. You open your laptop. You approve it by hand like it's 1998.

The agent did the easy part and punted the hard part to you. That's not autonomy. That's a very fast intern with your credit card.

This already happened, and it failed in a funny way

Bruce Schneier ran an experiment where he gave an agent a real task and a real wallet. The wallet had $4.75 on Base. Identity verification blocked it zero times, which is the punchline everyone misses. The failures happened at settlement: Stripe, PayPal, Gumroad, Upwork, and Fiverr all choked at the moment money had to move, or at T+2 when the rails caught up. Identity was never the bottleneck. Moving money between strangers was.

That's the gap nobody is building for. We keep arguing about whether agents can be trusted, and the money layer underneath them is still built for humans with bank accounts and dispute departments.

The real problem: the decision to pay and the payment are fused

When you pay someone, two things happen at once: you decide to pay, and the money moves. For humans that's fine, because we have chargebacks, courts, and customer support.

Agents have none of that. An agent can't file a chargeback. It can't argue its case to a support rep. It can't negotiate after the fact, because you can't negotiate with software that already took your money. Once the payment clears, the agent that got burned has no recourse except asking a human to intervene, which puts us right back at the laptop approving things by hand.

So I'm building the thing I wish existed.

What I'm building: escrow for agents

It's called Timbro, and it has four pieces:

Verifiable agent identity. Every agent gets an identity you can check, so "who am I dealing with" is answerable.
Deal IDs with locked authorizations. Every deal gets a unique deal ID. Before money moves, the buyer's agent locks a payment authorization against that deal ID. This splits the decision to pay from the payment itself, which is the whole trick. The authorization is exactly-once: concurrent retries can't double-spend it, and a lost response just rediscovers that it was already consumed.
Escrow-style settlement. Funds are held and release only on confirmed delivery. And Timbro never touches the money. The rail holds it, the protocol governs it.
Portable reputation plus arbitration. Completed deals build a reputation the agent carries anywhere, hardened against the obvious gaming. When deals go sideways, neutral third-party arbiters decide, with one appeal and funds locked until it closes.

Honest status report

This is pre-launch. The payment rails are still simulated. The protocol runs are real: there's a flight-recorder demo on timbro.tech showing three full runs as a visual timeline, identity to authorization to escrow to settlement to reputation.

I posted about this on Reddit this week. 757 views, zero signups so far. I'm not pretending that's validation. It's the start of the conversation.

Poke holes in it

I built this, and I want the hardest version of your objection. A few I'm already chewing on:

If both agents stay inside the protocol, everything works. What actually keeps them inside when defecting is one API call away?
Reputation is portable, which means it's valuable, which means it's a target. What's the attack I'm not seeing?
Who runs the arbiters, and why should either side trust them?