What Is Agent Escrow — and Why Agent-to-Agent Trade Needs It

Ask any fraud team what breaks when an AI agent becomes the buyer and you get the same answer: the signals vanish. Device fingerprint, typing cadence, mouse movement, time-of-day, the human hesitation before a big purchase — gone. As one industry analysis put it, “when the human is a Python script running in a cloud function, every one of those traditional fraud-detection signals disappears.” That is the problem escrow exists to solve.

What escrow actually is

Escrow is one of the oldest trust primitives in commerce: a neutral third party holds the value while two parties who do not trust each other each do their part. The buyer’s money is committed but not released; the seller delivers knowing the money is real; the holder releases funds only when the agreed conditions are met — or refunds them when they are not.

In human commerce, escrow is reserved for high-stakes, low-trust deals: houses, used cars, freelance contracts. In agent-to-agent trade, every deal is low-trust by default, because the counterparty is an autonomous program you have never met and cannot read body language from. Escrow ends up as the default rather than the exception.

The trust stack

Escrow does not stand alone. It sits in a stack, and the stack only works in order. You have to know who the agent is before you care what it was allowed to do. Securing the money is pointless if you can’t prove afterward what actually happened. Four layers, each leaning on the one before it.

How it composes with what shipped in 2025

The 2025 payment protocols built the layers around escrow — and deliberately left the hold itself as a gap to be filled. Two pieces matter most for a practitioner.

Stripe’s Shared Payment Token (SPT)is a scoped grant to use a buyer’s payment method without exposing the credential. Critically for escrow, an SPT can be scoped to a specific business, capped by amount, bounded by an expiry, revoked at any time, and watched via webhooks. [3][4] That is exactly the control surface a hold needs: a buyer agent can authorize a bounded, time-limited claim on funds rather than handing over an open-ended card number.

AP2’s Mandatessupply the consent. The Intent Mandate captures “Human-Not-Present” pre-authorization (budget, categories, timing) that lets an agent act later; the Cart Mandate captures the final “Human-Present” sign-off on an exact cart and price. Together they create a non-repudiable record of who authorized what, which is the evidence an escrow agent needs to release or refund without a he-said-she-said dispute. [5][6][7]

{
  "escrow": "springbrand",
  "amount": { "currency": "USD", "value": 240 },
  "funding": { "type": "stripe_spt", "scope": "seller_agent_x" },
  "authorization": {
    "intent_mandate": "ap2:intent:0x91f...",
    "cart_mandate": "ap2:cart:0x4ce..."
  },
  "release_condition": {
    "on": "proof_of_fulfillment",
    "deadline": "PT72H"
  },
  "on_timeout": "auto_refund",
  "audit": "append_only"
}

Traditional escrow vs. agent escrow

Agent escrow is not just traditional escrow with an API. The timescale, the counterparties, and the dispute mechanics are different enough to be a distinct primitive.

The failure modes it closes

The case for agent escrow is clearest in the specific ways agent-to-agent trade goes wrong — each one a hole that authorization alone does not plug:

• Unauthorized-by-confusion. An agent buys on a stale or misread preference; the human later denies a charge they do not recognize. Escrow plus a signed mandate gives both sides a record of exactly what was approved. [8]
• Rogue counterparty. A seller agent takes the money and never delivers. With escrow the funds were never released; the timeout auto-refunds.
• Liability gaps. Card schemes are reluctant to absorb losses for agent transactions they did not authorize. A neutral hold with a clear release rule keeps the risk contained and assignable.
• Settlement races. Two agents both believe the deal closed in different states. Escrow makes settlement atomic: it either releases fully or refunds fully, never halfway.

At SpringBrand, escrow is not a feature bolted onto checkout. It is the layer that turns a machine-readable commitment into a deal two strangers’ agents can safely execute. Identity establishes who the agent is, the mandate fixes what it was allowed to do, escrow holds the value until the conditions are met, and the audit trail leaves a record nobody can argue with. Put those four together and you have about the smallest trust stack agent-to-agent commerce can run on, with escrow doing the load-bearing work in the middle.