Bounded Subcontracting and Agent-to-Agent Procurement: Formal Frameworks for Economic Delegation

Full report

On this page

The deployment of multi-agent systems has evolved rapidly from isolated, domain-specific experimental models into interconnected economic networks where artificial intelligence agents operate as autonomous economic actors. As agents become capable of sustained autonomous operation spanning hours or days, traditional coordination protocols are proving insufficient to govern their behavior, manage their legal liability, and bound their resource consumption1. The historical foundation of task allocation in distributed systems, the Contract Net Protocol (CNP) of 1980, established a paradigm of manager agents announcing tasks and contractor agents submitting bids3. However, CNP fundamentally assumes a homogeneous environment of cooperative agents without formal constraints on resource scarcity, financial budgets, or adversarial economic behavior3. Modern agent protocols have standardized connectivity and tool usage, yet they frequently lack normative mechanisms to bound how much an agent may consume or how long it may operate1. This deficiency manifests in severe systemic failures, such as agents falling into recursive clarification loops that generate massive, unbounded API billing costs before human operators can intervene1. The transition from basic workflow automation to true agent-to-agent procurement necessitates a formal framework that extends the contract metaphor from simple task allocation to rigorous, resource-bounded execution with explicit lifecycle semantics1. To resolve these systemic gaps, advanced multi-agent architectures are adopting formal economic and cryptographic mechanisms, such as the Agentic Settlement Protocol (ASP) and the x402 standard, to facilitate trustless, delayed-fulfillment commerce between autonomous entities9. Bounded subcontracting in this context requires strict adherence to budget conservation invariants, ensuring that delegated subtasks respect parent constraints and that authority strictly attenuates as it propagates through a delegation hierarchy1. This report provides an exhaustive analysis of agent-to-agent procurement, formalizes the mechanics of bounded subcontracting, examines pathological architectural failures, and presents a comprehensive mathematical and structural model for resolving dependencies, budget allocations, and race conditions in decentralized agent economies.

Multi-Agent Workflow Versus Economic Procurement Patterns

Understanding bounded subcontracting requires drawing a sharp distinction between multi-agent workflow orchestration and true economic procurement. While both paradigms involve multiple agents collaborating to achieve an overarching objective, their underlying trust models, data boundaries, and financial responsibilities are fundamentally different.

Orchestration Convenience and Shared Trust Boundaries

Multi-agent workflow orchestration represents a division of labor designed purely for functional convenience. In systems engineered for parallel progress, specialized tool usage, or separation of working contexts, a central application or orchestrator dictates the stages, transitions, and branches of execution12. The orchestrator retains full economic responsibility and complete visibility over the system. Agents within an orchestrated workflow typically share the same trust boundary, operate under the same funding source, and rely on centralized state management, such as a shared blackboard or event choreography12. In these closed environments, a manager agent assigns tasks to worker agents based on predefined roles, but the manager does not technically "purchase" a service. Instead, it delegates a computational thread. If a worker agent fails, the orchestrator simply retries the task, re-routes it to another internal model, or prompts a human for intervention. The failure incurs a minor latency penalty and a marginal cost in token consumption, but it does not trigger complex legal or economic dispute resolutions because the entire collective operates under a single principal's legal and financial liability2. The objective of orchestration is to mitigate the difficulty large language models face with tightly interdependent tasks by compartmentalizing context windows, not to distribute financial risk12.

The Shift to Economic Responsibility and Adversarial Procurement

Agent-to-agent procurement introduces a fundamentally different paradigm characterized by crossed trust boundaries, distributed economic responsibility, and the potential for adversarial behavior. In an open agentic marketplace, a buyer agent procures specialist subtasks from independent seller agents representing distinct legal and financial entities14. This procurement introduces the classical principal-agent problem into machine-to-machine interactions, specifically the challenges of adverse selection (hidden information before contracting) and moral hazard (hidden actions after contracting)16. Because the buyer agent cannot observe the internal execution strategy or computational effort of the seller agent, the buyer must rely on incomplete contracts that separate success criteria from execution methods1. In this adversarial environment, an orchestrator cannot simply command a sub-agent. Instead, the interaction requires capability discovery, negotiation, binding commitments, and cryptographic escrow6. The economic responsibility shifts entirely: the seller agent becomes economically liable for delivering the verified outcome within the agreed-upon resource bounds, while the buyer agent is responsible for locking the necessary funds in a secure, non-custodial smart contract prior to execution15. The distinction between orchestration and procurement is most visible in the treatment of operational failures. In a procurement pattern, a failure by a sub-contractor does not merely necessitate a simple retry loop; it triggers an automated dispute resolution process, potential slashing of staked collateral, and the rigorous verification of cryptographic attestations to determine liability20. The orchestration convenience of shared memory is replaced by the strict economic necessity of verifiable, zero-trust data exchange over decentralized rails.

Settlement Rails and the x402 Protocol

The technical execution of agentic procurement relies heavily on specialized transport and settlement layers that do not require human intervention. The x402 standard has emerged as a primary HTTP-native payment protocol for this purpose, reviving the long-dormant HTTP 402 "Payment Required" status code into a machine-readable payment challenge10. When a parent agent attempts to procure a subtask from a specialized child agent without prior authentication, the child's server responds with an HTTP 402 status, returning a WWW-Authenticate: Payment header containing payment metadata such as the cost, accepted stablecoins, and the destination address10. The parent agent parses this challenge, utilizes its explicitly delegated payment authorization to sign a blockchain transaction, and retries the request with a PAYMENT-SIGNATURE header22. A facilitator node or middleware validates the signature, settles the transaction on an EVM-compatible chain or Solana, and allows the request to proceed22. This mechanism strictly separates the authorization of the task from the execution, enforcing the economic boundary required for trustless subcontracting.

Formalizing Parent and Child Task Delegation

To operationalize bounded subcontracting in environments governed by x402 or similar protocols, the interaction between a delegating parent agent and a contracted child agent must be codified into a rigorous, machine-readable governance mechanism.

The Agent Contract Tuple

The foundational structure for this governance is the Agent Contract, a formal theoretical framework that transforms an autonomous large language model agent into a resource-bounded algorithmic entity8. The contract is strictly defined as a formal seven-tuple: [Figure omitted from source export] This tuple unifies the required elements of the delegation, transforming arbitrary natural language prompts into enforceable operational boundaries1. The input specifications ([Figure omitted from source export]) and output specifications ([Figure omitted from source export]) define the exact data schemas and types expected by the contracting parties, allowing the caller to reject malformed outputs without requiring secondary models to grade prose27. The state constraints ([Figure omitted from source export]) dictate the operational environment and required preconditions1. The multi-dimensional resource constraints ([Figure omitted from source export]) establish strict boundaries on token consumption, API usage, and absolute financial expenditure (max\_usd), ensuring that estimates are replaced with hard guardrails27. The temporal boundaries ([Figure omitted from source export]) define the maximum execution time (max\_seconds) and expiration deadlines28. The success criteria ([Figure omitted from source export]) operate as explicit obligations that the agent must achieve to trigger payment, while the lifecycle semantics ([Figure omitted from source export]) dictate the regimented enforcement protocols, such as automatic termination or graceful degradation upon a constraint violation1.

Budget Allocation and Conservation Invariants

A critical principle of multi-agent delegation is that coordination mechanisms must respect strict conservation laws through structural induction1. A parent agent cannot delegate resources or authority it does not possess. Therefore, when a parent agent spawns child tasks, the aggregate budget allocated to the delegation tree must be strictly bounded by the parent's own resource constraints. If a parent contract is endowed with a maximum budget [Figure omitted from source export], and it seeks to delegate [Figure omitted from source export] child tasks, the system must enforce the invariant that the sum of the maximum allowable budgets for all child tasks ([Figure omitted from source export]), plus the parent's retained margin and operational reserve ([Figure omitted from source export]), strictly equals the initial funded budget. The continuous enforcement of this invariant prevents the double-counting of allocated funds and ensures that infinite recursive spending is mathematically impossible across the delegation hierarchy1. Furthermore, this allocation must occur entirely ex-ante. A fundamental rule of sound agentic commerce and bounded subcontracting is that a parent agent cannot authorize a child task based on the assumption of expected future revenue or unsecured accounts receivable. Funds must exist, be fully authorized, and reside in a cryptographic escrow vault before any downstream economic commitment is legally or technically binding9.

Worker Disclosure and Unrestricted Data Scoping

When a parent delegates to a child, the transfer of information and authority must follow the principle of least privilege. A child task cannot inherit unrestricted parent data or unlimited spending authority. Providing a subcontractor with the full context window or historical memory of the parent introduces severe security and privacy vulnerabilities, escalating the risk of prompt injection, data exfiltration, and unauthorized permission escalation across the network32. Worker disclosure protocols mandate that the parent synthesizes and sanitizes the required context, passing only the exact parameters defined in the input specification ([Figure omitted from source export]) of the Agent Contract. Furthermore, the identity and capabilities of the worker (the child agent) must be cryptographically disclosed and verified against a registry of credentials before the parent releases the task payload. This ensures that high-criticality or high-context tasks are not routed to unverified, thin-file, or under-collateralized actors operating under opaque non-human identities14.

Verification Responsibility and Cryptographic Attestation

In an incomplete contract characterized by moral hazard, the responsibility for verifying the child's output rests firmly with the parent agent (or an independent arbiter designated by the parent) before the escrowed funds are released12. The child must deliver not only the functional output but also a cryptographic attestation of its execution, proving that the execution remained within permitted bounds. Frameworks such as the OVERT standard specify how runtime controls generate independently assessable records of execution without requiring the egress of protected content36. At the infrastructure layer, this is achieved through strict sandboxing, such as the ARLI protocol, which restricts the child agent using Linux kernel-level sandboxing (Landlock and seccomp BPF)37. Every system call, file read, and network request made by the child is logged in the Open Cybersecurity Schema Framework (OCSF) format, hashed with SHA-256, and signed with an ed25519 private key to form a cryptographic attestation37. The parent agent, or the smart contract escrow, verifies this attestation on-chain before authorizing the settlement, eliminating the trust gap inherent in remote subcontracting.

Cancellation Propagation and Treatment of Failed Children

If a parent task is canceled by the ultimate human user or an upstream orchestrator, that cancellation must propagate deterministically through the entire delegation hierarchy. Cancellation propagation ensures that all active child processes receive immediate termination signals, halting further resource consumption and preventing process-boundary leaks19. Any contingent fees held in escrow for incomplete child tasks are voided and reclaimed by the parent, while accrued fees for already finalized subtasks are settled immediately9. Conversely, if a child task fails or is disputed, the failure does not automatically crash the parent or cause a cascading default across the supply chain28. The parent agent captures the defined failure payload, reclaims the escrowed funds associated with that specific child contract, and autonomously evaluates its recovery options28. Depending on its own temporal and financial constraints ([Figure omitted from source export] and [Figure omitted from source export]), the parent may retry the task with a different provider, attempt a different execution topology, or degrade gracefully and report a partial failure up the chain28.

Legal Liability and Accountability Gaps

The deployment of autonomous agents into economic procurement roles creates significant friction with traditional legal systems, which inherently assume human agency. When an agent autonomously negotiates, purchases, and delegates tasks, determining legal liability for failures or damages becomes highly complex. Traditional civil liability frameworks, such as those governing corporate attribution or vicarious liability, struggle with the "responsibility gap" created by autonomous systems2. If an agent makes a purchasing error or violates a third-party contract, liability cannot simply be assigned to the machine, as it lacks legal personality2. Instead, courts must determine whether the agent acted within its apparent or actual authority, whether the deploying company was negligent in its supervision, or whether the developer is liable for defective system design2. In a multi-agent procurement chain, this liability is highly fragmented. If a parent agent delegates a task to a child agent, and the child agent commits a violation, the parent's principal may still bear the legal liability under the doctrine of non-delegable duty, which mandates that the principal must ensure care is taken, regardless of the independent contractor's status2. To mitigate these risks, advanced agentic frameworks are exploring "computational jurisprudence," incorporating sealed delegation chains and graduated attribution to mathematically prove which entity authorized a specific action, thereby bridging the accountability gap11. Furthermore, proposals for "treaty-following AI" suggest embedding legal constraints directly into the agent's core optimization functions, ensuring they refuse actions that violate designated legal agreements46.

Pathological Architectures: Depth, Cycles, and Self-Dealing

Without rigorous architectural constraints, bounded subcontracting mechanisms can easily degrade into pathological states that consume vast resources without generating utility, exposing principals to unbounded liability. The design of multi-agent procurement protocols must inherently defend against recursive expansion, circular dependencies, self-dealing, and temporal paradoxes.

Recursive Expansion and Maximum Depth

Autonomous agents possess the capability to spawn sub-agents on demand, enabling dynamic team formation and hierarchical self-organization1. However, without strict depth limitations, an agent encountering a difficult problem might recursively delegate the task to a slightly modified clone of itself, leading to an infinite descent of delegation. This recursive clarification loop acts as the economic equivalent of a stack overflow, rapidly depleting the parent's budget across hundreds of useless micro-transactions1. To prevent this, the Agent Contract tuple must enforce a strict max\_depth parameter. Each level of delegation strictly decrements this parameter. When max\_depth reaches zero, the agent is mathematically prohibited from spawning further sub-agents and must either fulfill the task using its own reasoning capabilities or fail gracefully, thereby bounding the execution tree13.

Circular Dependencies and Deadlocks

In complex decentralized workflows, Agent A may subcontract a data-processing task to Agent B, which in turn subcontracts a validation task to Agent C. If Agent C requires contextual synthesis from Agent A to complete its validation, a circular dependency emerges. In traditional software, circular dependencies cause compilation errors or infinite loops; in agentic commerce, they cause escrow deadlocks where funds are permanently locked because no agent can finalize its success criteria to trigger payment13. Mitigation requires static Directed Acyclic Graph (DAG) verification prior to contract execution. Frameworks utilizing Retrieval-Guided Adaptive Orchestration (RGAO) parse the proposed delegation forest in [Figure omitted from source export] time to detect and reject cyclical topology configurations before any LLM inference or financial commitment is initiated30. Furthermore, explicit timeout mechanisms ensure that if a deadlock does slip through, the contracts expire, and funds are automatically refunded to the respective principals47.

The Hold-Up Problem and Self-Dealing

The integration of independent economic agents introduces severe game-theoretic vulnerabilities. The "hold-up problem" occurs when a contracted agent, knowing that the parent agent faces a strict overarching deadline or significant sunk costs, demands additional compensation to release its completed output48. Cryptographic escrow neutralizes the hold-up problem by completely removing the capacity for ex-post renegotiation. The exact payment is locked upon contract initiation and is released deterministically by a smart contract the moment the success criteria are cryptographically proven, bypassing the contractor's ability to extort the parent15. A related vulnerability is "self-dealing," wherein an orchestrator agent or a marketplace distributor delegates tasks to its own hidden sub-agents to farm referral fees, revenue shares, or platform subsidies9. The Agentic Settlement Protocol (ASP) prevents this through stringent revenue share caps at the moment of capture, enforcing a strict mathematical condition where the net profit from a referred charge is always definitively negative for the distributor if they secretly act as the buyer, thereby making circular self-dealing provably unprofitable9.

Incompatible Deadlines and the Three-Deadline Model

Temporal bounds are critical in digital commerce. If an agent books a non-refundable computing instance that expires at 12:00 PM, but the blockchain escrow holding the payment expires at 11:50 AM, a temporal mismatch occurs. The buyer could unilaterally reclaim the escrow at 11:51 AM while still consuming the computing resource until 12:00 PM, leaving the seller uncompensated19. To resolve incompatible deadlines, robust procurement protocols utilize a three-deadline hold model. This model enforces an explicit submission-inclusion-finality margin ([Figure omitted from source export]) between the issuance deadline ([Figure omitted from source export]), the on-chain escrow hold expiration ([Figure omitted from source export]), and the off-chain engine inventory expiry ([Figure omitted from source export]). The invariant dictates that: [Figure omitted from source export] This cryptographic guarantee ensures that no inventory is ever issued against funds that the buyer agent could legally reclaim due to clock drift, network congestion, or finality delays, protecting the seller's economic interests9.

Example Formulation: Coordinator, Researcher, and Verifier

To illustrate the mechanics of bounded subcontracting without double-counting budgets or spending un-accrued revenue, the following scenario details an economic workflow. An external client funds a Coordinator agent ([Figure omitted from source export]) to deliver a comprehensive, verified market report. The Coordinator utilizes its explicitly delegated authority to procure two specialized sub-agents: a Researcher ([Figure omitted from source export]) and a Verifier ([Figure omitted from source export]).

Proposed Task and Delegation Graph

The delegation topology relies on a strictly sequential DAG to prevent circular dependencies. The Coordinator is the parent, acting as the manager, while the Researcher and Verifier act as independent contractors.

Tracking Commitments, Fees, and Margins

The client establishes a total operating budget of \$100.00 USDC, locked into an on-chain escrow vault pointing to [Figure omitted from source export]'s contract. The Coordinator cannot spend anticipated revenue; it can only sub-allocate from this cryptographically secured vault. To maintain strict accounting and avoid the double-counting of reserve requirements against the capital budget31, the total budget ([Figure omitted from source export]) is continuously tracked across four mutually exclusive state variables:

1. Uncommitted Authority ([Figure omitted from source export]): Funds available for new delegation.

2. Contingent Fees ([Figure omitted from source export]): Funds locked in active child contracts, awaiting delivery.

3. Accrued Fees ([Figure omitted from source export]): Funds finalized and released to child agents.

4. Prospective Margin ([Figure omitted from source export]): The Coordinator's ultimate profit, assuming successful completion.

The budget-conservation invariant is mathematically defined as: [Figure omitted from source export] The lifecycle of the transaction proceeds through defined states, ensuring the invariant holds true at every timestamp:

At no point does the Coordinator's spending authority exceed the bounds established by the parent contract. The \$40 prospective margin is explicitly protected, remaining uncommitted throughout the execution, ensuring the orchestrator retains its economic incentive without violating the conservation laws or creating a fractional reserve vulnerability.

Concurrency, Race Conditions, and Failure Cases

The introduction of asynchronous cryptographic execution and decentralized multi-agent network topologies inevitably creates complex edge cases. A robust framework must deterministically resolve race conditions and failure states without manual intervention, maintaining system integrity regardless of Byzantine behavior.

Case 1: Cancellation During Child Completion

Scenario: The external client cancels the overarching parent contract precisely as the child agent ([Figure omitted from source export]) is transmitting its final payload and cryptographic attestation to the blockchain. Resolution: The cancellation propagation mechanism broadcasts a termination signal. However, resolution depends strictly on cryptographic sequencing. If the child's cryptographic proof of execution reaches the mempool and is sequenced into a block before the parent's cancellation transaction, the child's execution is deemed finalized. The escrow contract executes the payment to the child using the contingent fees ([Figure omitted from source export]). The parent absorbs this cost, returning the remaining uncommitted balance ([Figure omitted from source export]) and margin to the client. If the cancellation arrives first, the child's transaction reverts, and all contingent fees are refunded to the parent15.

Case 2: Parent Failure After Valid Child Work

Scenario: The child agent ([Figure omitted from source export]) successfully completes its verification task and submits the attestation, but the parent agent ([Figure omitted from source export]) crashes due to a logic error or out-of-memory exception before it can explicitly accept the delivery and authorize the release of funds. Resolution: Agentic escrow mechanisms utilize an optimistic release pattern to protect the subcontractor15. When the child agent submits the cryptographic attestation to the vault, a predefined challenge window opens. Because the parent agent has crashed, it cannot lodge a dispute. Once the challenge window expires, the smart contract automatically executes the optimisticRelease function, transferring the contingent \$20 to the child. The child is guaranteed payment despite the parent's technical failure, eliminating counterparty risk.

Case 3: Malicious Child Attempting Budget Exhaustion

Scenario: A compromised or poorly designed child agent ignores its termination criteria and attempts to endlessly call expensive external API tools, expecting the parent to cover the accumulating token costs. Resolution: The Agent Contract enforces a strict resource bound ([Figure omitted from source export]) that operates as a hard prohibition1. Because the child is a distinct economic actor, the parent's liability is strictly capped at the contingent fee ([Figure omitted from source export]) locked in escrow. The child's execution environment or the decentralized inference provider will halt the child's process the moment its dedicated funding is exhausted. The parent's remaining uncommitted budget ([Figure omitted from source export]) is cryptographically insulated from the child's cost overruns1.

Case 4: Incompatible Timeout Resolution

Scenario: A parent agent accidentally drafts a contract where the child agent's execution deadline ([Figure omitted from source export]) is set to 72 hours, but the parent's own escrow expiration ([Figure omitted from source export]) is set to 48 hours. Resolution: The static DAG verifier rejects the contract configuration at runtime before any funds are committed. The system enforces the temporal invariant that all child execution deadlines, plus the necessary network finality margin, must be strictly less than the parent's expiration ([Figure omitted from source export])9. The parent is forced to re-issue the contract with valid temporal parameters or the orchestration halts.

Case 5: The Double-Spend Fan-In Race

Scenario: A parent agent spawns two parallel child tasks. Due to a concurrent state synchronization error, the parent promises a \$60 budget to Child A and a \$60 budget to Child B, despite only possessing \$100 in uncommitted authority. Resolution: Because the budget conservation law is enforced at the smart contract level rather than the application level, the second transaction to reach the ledger will fail due to insufficient authorized funds30. The blockchain acts as a centralized state machine for the budget algebra, preventing the creation of unbacked contingent fees and eliminating the double-spend vulnerability.

Case 6: Dispute Escalation and Attestation Mismatch

Scenario: A child agent delivers a dataset that perfectly matches the required JSON schema (passing the automated structural checks), but the data is completely hallucinated or semantically useless. The parent agent disputes the payment. Resolution: Cryptographic conduit verifiers only prove that an agent took specific actions; they do not prove semantic intent or accuracy21. This scenario triggers the Agent Dispute Resolution Protocol (ADRP)21. The parent submits a challenge within the escrow challenge window. A decentralized arbitration council—governed by staked human or high-reputation agent oracles, as proposed in Ethereum frameworks like EIP-8033—reviews the evidence54. If the child is found to have acted maliciously, the arbiters issue a RulingBundle that cryptographically supersedes the child's initial ProofBundle via a signing-time precedence rule21. The child forfeits its contingent fee, and its staked collateral may be slashed to penalize the Byzantine behavior20.

Minimum Viable Subcontracting and the Human Boundary

Implementing the entire suite of agentic procurement protocols is mathematically dense and computationally heavy. System architects must determine the smallest useful subset of these features to deploy, as well as define the strict boundary where autonomous procurement must yield to human oversight.

The Smallest Useful Subcontracting Feature

The minimum viable feature for bounded subcontracting is the deployment of typed task contracts integrated with a simple, unidirectional escrow vault. As established in recent literature on agent governance, natural language prompt instructions are an insufficient interface for economic delegation because they lack lifecycle semantics and machine-readable failure modes28. The smallest useful architecture requires:

1. A machine-readable JSON or YAML schema dictating the exact shape of the expected output and the defined failure payload28.

2. A rigid max\_usd or token boundary that serves as a hard termination trigger, enforced by the inference provider27.

3. A max\_seconds temporal boundary making the failure timeline explicit28.

4. A non-custodial escrow mechanism that holds the exact value of max\_usd and releases it only upon schema-compliant delivery.

This primitive configuration eliminates 90% of recursive billing errors and provides a clean integration point for API-driven payments like x402, without requiring the full overhead of complex arbitration mandates or rolling reserves1.

Where Manual Approval Remains Preferable

Despite the efficiency of autonomous procurement, fundamental limitations in AI alignment and the principal-agent problem mandate that certain thresholds of delegation remain bound to human approval. The delegation calculus dictates that manual approval is required based on two primary axes: verifiability and reversibility32. If a task possesses extremely low verifiability—meaning the cost and difficulty of validating the outcome is nearly as high as performing the task itself (e.g., open-ended strategic research, subjective qualitative analysis, or novel intellectual property generation)—automated escrow release is inappropriate32. In accordance with the Minimum Sufficient Oversight (MSO) principle, a human must act as the arbiter to assess semantic quality before funds are released, as mathematical verification fails to capture nuanced intent55. Furthermore, tasks characterized by high criticality and irreversibility must enforce human-in-the-loop escalation paths. If an agentic action produces side effects in the physical or financial world that cannot be undone—such as executing a large-scale financial trade, deleting external production infrastructure, or signing legally binding real-world contracts—the system must sever the automated execution link13. In these instances, the parent agent may autonomously synthesize the context, select the provider, and negotiate the terms, but the final cryptographic signature authorizing the action and the budget release must require human multi-factor authentication, ensuring that ultimate liability remains tethered to human judgment.

Works cited

1. Agent Contracts: A Formal Framework for Resource-Bounded ... \- arXiv, https://arxiv.org/html/2601.08815v1

2. Civil Law And Uae Liability Attribution In Multi-Agent Systems, https://www.lawgratis.com/blog-detail/civil-law-and-uae-liability-attribution-in-multi-agent-systems

3. Agent Capability Negotiation and Binding Protocol (ACNBP) \- arXiv, https://arxiv.org/pdf/2506.13590

4. Contract Net Protocol Based-on Multiagent System for Desirable, https://meral.edu.mm/record/3717/files/54027.pdf

5. Decentralized Supply Chain Formation: A Market Protocol and, https://jair.org/index.php/jair/article/download/10347/24742/19113

6. Agent Capability Negotiation and Binding Protocol (ACNBP) \- arXiv, https://arxiv.org/html/2506.13590v1

7. A Formal Framework for Resource-Bounded Autonomous AI Systems, https://arxiv.org/abs/2601.08815

8. A Formal Framework for Resource-Bounded Autonomous AI Systems, https://arxiv.org/pdf/2601.08815

9. \[Revisión de artículo\] Agentic Settlement Protocol: An Application, https://www.themoonlight.io/es/review/agentic-settlement-protocol-an-application-profile-for-refundable-delayed-fulfilment-agent-commerce-on-stablecoin-rails

10. What is x402? The Internet Native Payments Standard for APIs and, https://formo.so/blog/x402-explained-internet-native-payments-standard

11. Computational Jurisprudence: Verifiable Law for Machine Societies, https://www.preprints.org/manuscript/202607.1528

12. Multi-Agent Systems: Dividing Work Without Losing the Whole Task, https://ai.engineer/topics/multi-agent-systems

13. Hierarchical Agent Systems: Manager, Specialist, and ... \- Ruh AI, https://www.ruh.ai/blogs/hierarchical-agent-systems

14. LEGIT: Credentialing Protocol for Trustworthy AI Agent Marketplaces, https://arxiv.org/html/2609.21325v1

15. Cryptographic Escrow for AI Agents: How Smart Contracts Enforce, https://a2awire.com/content/cryptographic-escrow-for-ai-agents/

16. Agency Theory: A review \- TheoryHub \- Newcastle University, https://open.ncl.ac.uk/theories/21/agency-theory/

17. Rationalizable Screening and Disclosure under Unawareness \- arXiv, https://arxiv.org/pdf/2510.20918

18. Inherent and emergent liability issues in LLM-based agentic systems, https://arxiv.org/html/2504.03255v2

19. (PDF) Agentic Settlement Protocol: An Application Profile for, https://www.researchgate.net/publication/413926244\_Agentic\_Settlement\_Protocol\_An\_Application\_Profile\_for\_Refundable\_Delayed-Fulfilment\_Agent\_Commerce\_on\_Stablecoin\_Rails

20. Agent Terms & Conditions \- Zenland DAO, https://zen.land/agent-tos

21. draft-stone-adrp-00 \- ADRP: Agent Dispute Resolution Protocol, https://datatracker.ietf.org/doc/draft-stone-adrp/00/

22. x402 and Agent-to-Agent Payments: Protocol Guide and Comparison, https://www.openfort.io/blog/x402-agentic-payments

23. x402 and MPP: how they work, how they're different \- Quicknode, https://www.quicknode.com/blog/x402-vs-mpp

24. x402 Protocol on Sei \- Sei Docs, https://docs.sei.io/ai/x402

25. x402: The HTTP Payment Protocol That Lets AI Agents Spend, https://www.spark.money/research/x402-protocol-ai-agent-payments

26. x402: A Payment Rail for Onchain Agents, https://www.blog.blockscout.com/x402-onchain-agents/

27. Agent Contracts: A Formal Framework for Resource-Bounded ... \- arXiv, https://arxiv.org/html/2601.08815v3

28. Agent Frameworks Need a Typed Task Contract \- neromedia, https://neromedia.faion.net/en/agent-frameworks-need-typed-task-contracts/

29. Agent Behavioral Contracts: Formal Specification and Runtime, https://arxiv.org/html/2602.22302v1

30. Retrieval-Conditioned Topology Selection with Provable Budget, https://arxiv.org/pdf/2605.05657

31. Notes to Financial Statements \- Carrboro, NC, https://www.carrboronc.gov/DocumentCenter/View/12428/3c---Notes-to-Financial-Statements

32. Intelligent AI Delegation \- arXiv, https://arxiv.org/html/2602.11865v1

33. Agent Trust Glossary \- Signet, https://agentsignet.com/glossary

34. From Logic Monopoly to Social Contract: Separation of Power and, https://arxiv.org/html/2603.25100v1

35. HeLa Chain: Sovereign Infrastructure for the AI-Native Economy, https://blog.helachain.com/whitepaper/

36. An Open Standard for Runtime Trust in AI Systems \- OVERT, https://overt.is/OVERT\_v1.1\_STANDARD.pdf

37. ARLI — Verifiable AI Agent Execution \- ENSO, https://7rwvv-hqaaa-aaaaa-qhhfa-cai.icp0.io/arli

38. vincio · PyPI, https://pypi.org/project/vincio/2.2.1/

39. gateway-orchestrator-contract \- Agent Skills Library, https://skills.rest/skill/gateway-orchestrator-contract

40. OPTIONS PAPER \- NEM financial market resilience \- AEMC, https://www.aemc.gov.au/sites/default/files/content/9e3e54d9-e528-47c3-b302-2e69b4888f22/Options-paper.pdf

41. China Evergrande Group SWOT Analysis \- Porter's Five Forces, https://portersfiveforce.com/products/evergrande-swot-analysis

42. Versioning, Rollback & Lifecycle Management of AI Agents \- Medium, https://medium.com/@nraman.n6/versioning-rollback-lifecycle-management-of-ai-agents-treating-intelligence-as-deployable-deac757e4dea

43. LIABILITY FOR INDEPENDENT CONTRACTORS IN CONTRACT, https://www.cambridge.org/core/journals/cambridge-law-journal/article/liability-for-independent-contractors-in-contract-and-tort-duties-to-ensure-that-care-is-taken/9844A3441D260FAEC7983E2C2CFE771F

44. Full article: The ethical legitimacy of autonomous Weapons systems, https://www.tandfonline.com/doi/full/10.1080/16544951.2025.2540131

45. A Legal Theory For Autonomous Artificial Agents \- Chopra y White, https://www.scribd.com/document/632122074/A-legal-theory-for-autonomous-artificial-agents-Chopra-y-White

46. Treaty-Following AI \- Institute for Law & AI, https://law-ai.org/treaty-following-ai/

47. Designing Multi-Agent Systems for Real-World Teams, https://www.meritdata-tech.com/resources-post/designing-multi-agent-systems

48. A mechanism-design approach to property rights \- Ellen Muir, https://ellenmuir.net/papers/Dworczak-Muir-MDPR-2025.pdf

49. Bridging the governance gap in agricultural blockchain-based smart, https://www.frontiersin.org/journals/blockchain/articles/10.3389/fbloc.2026.1762861/full

50. P2P Crypto Exchange Development Guide 2026 \- Appinventiv, https://appinventiv.com/blog/p2p-crypto-exchange-development/

51. Digital technology adoption barriers and solutions for sustainable, https://www.tandfonline.com/doi/full/10.1080/13467581.2026.2679892

52. Agentic Settlement Protocol: An Application Profile for Refundable, https://arxiv.org/html/2609.02208v1

53. What Are Replacement Reserves in Real Estate? | PropRise, https://www.proprise.ai/primer/resources/glossary/replacement-reserves/

54. ERC-8033: Agent Council Oracles \- Ethereum Improvement Proposals, https://eips.ethereum.org/EIPS/eip-8033

55. A Formal Framework for Resource-Bounded Autonomous AI Systems, https://www.semanticscholar.org/paper/Agent-Contracts%3A-A-Formal-Framework-for-Autonomous-Ye-Tan/46682696b006815a79af4b04926200d4d8e3b99c