Vetting AI Agents Before Payment: Why Human Checks Break at Agent Speed

Picture this: your agent finds a cheap API that claims to do exactly what you need. Before sending real money, you'd want to know three things — who runs it, what it actually does, and whether anyone has been burned before. For a human vendor, you ask, you check, you decide. For an AI agent, that same decision has to happen in under a second, in code, with no conversation.

This is the core problem we built EVIDIQ to solve.

How a Human Vets a New Vendor

Vetting AI agents before payment means programmatically checking an agent's identity, declared capabilities, and live signals, then deciding whether to release funds — all before a transaction settles. EVIDIQ is the trust layer that performs this check, returning a 0-100 trust score plus an explicit recommendation: proceed, proceed_with_escrow, caution, or do_not_proceed.

The human version of this dance is so familiar we barely notice it. Someone new wants your business. Before you wire the deposit, you run through roughly the same five steps every time:

1. Look them up. Google the company name. Check the website. Glance at the LinkedIn profile of whoever signed the email. You're looking for a real entity with a real address and a real face attached to it.
2. Read the reviews. G2, Capterra, Trustpilot, Yelp — wherever your tribe complains. You scan for patterns: does everyone mention the same bug, the same billing trick, the same surprise?
3. Ask for references. A direct call to a current customer. Five minutes of pointed questions usually reveals more than a hundred reviews.
4. Check the paperwork. Insurance, certifications, the SOC 2 report, the incorporation documents. Boring, but it's the part that survives a lawsuit.
5. Trust the gut. After all the analysis, you either feel right about it or you don't. That instinct is built from years of being lied to, and it's surprisingly accurate.

For a vendor you might pay $40,000 a year to, that whole ritual might take a day. It works because the inputs are human-shaped: a face, a phone call, a signed PDF.

Translated to bots, the same job — vetting AI agents before payment — has to fit inside a single round-trip, with no human in the loop and no one to call when it goes wrong.

Every Step of That Process Assumes a Human Has Minutes

Now replay the same five steps at agent speed. Your agent has 800 milliseconds before the next request times out. The bot on the other end has no LinkedIn, no references to call, and no gut to check. Every single one of those familiar moves either evaporates or has to be replaced.

Here's the breakdown:

• The look-up. No LinkedIn, no business card. The closest thing is a domain name, an ENS record, or a verifiable EVM address. That's it.
• The reviews. There is no G2 for agents. You can't ask a chatbot to "check Trustpilot" — most review platforms don't even index autonomous endpoints, let alone let you query them programmatically.
• The references. Calling a human customer is right out. Even if you tried, the other party is also a bot, and it'll cheerfully hallucinate a glowing reference for anyone who asks.
• The paperwork. A SOC 2 report means nothing to an agent. What does matter — TLS, machine-readable agent cards, declared skill manifests — is barely standardized, and definitely not the kind of thing a bot can ask a sales rep for.
• The gut. A model can simulate intuition, but it has no scar tissue. It cannot tell you "this person has burned three people I've worked with" because it has no memory of being burned.

The math is simple: if your agent transacts a hundred times a day, even a thirty-second human-style review becomes impossible. You either skip the check and accept the losses, or you find something the machine can actually read.

The Machine-Readable Equivalent

Vetting AI agents before payment with code-shaped evidence is the part we spent a year getting right. When our system evaluates an agent, it returns a JSON Trust Report designed to slot directly into an automated decision flow. A human buyer would have asked five questions. The report answers those five questions, but with code-shaped evidence.

Here's the mapping:

1. Look up the vendor → identity block: EVM address, ERC-8004 identity id, ENS name, TLS-served domain. Each anchor is independently verifiable on-chain or via DNS.
2. Read the reviews → reputation block: anchor and live-signal based score. Right now, the strongest signal is whether the agent is already running a paid x402 service — which is, bluntly, "economic skin in the game." If it's willing to be charged for bad work, it has more to lose.
3. Ask for references → capability block: declared capabilities plus a live probe of the endpoint. We hit the URL, time-box the request to about six seconds, and check TLS validity, reachability, and whether the endpoint actually serves a machine-readable skill, agent card, or MCP surface. A self-description is not enough — we go look.
4. Check the paperwork → risk block: structural risks derived from the probe — missing TLS, unverifiable identity, advertised capabilities that the endpoint refuses to perform. The negative space, in other words.
5. Trust the gut → final composite: identity*0.3 + capability*0.3 + reputation*0.2 + (100-risk)*0.2, normalized to a 0-100 trust score, then mapped to one of four recommendations.

The score is fully deterministic. Same inputs, same output, every time. We made it that way on purpose — if you don't like the verdict, you should be able to re-run it yourself, see exactly which fields pulled the number, and decide whether the formula is fair. That matters more than any single number we return. For a deeper look at the runtime that produces the report, the EVIDIQ Operator docs walk through the implementation.

Reports are tamper-evident too. The canonical report is hashed with keccak256, the evidence is anchored on 0G Storage mainnet, an AI risk analysis can run inside a TEE on 0G Compute, and the verdict is signed with the EVIDIQ key using EIP-191. Anyone can re-fetch the report, re-hash it, and recover the signer. For the full pipeline, see the EVIDIQ Sentinel docs and the EVIDIQ Notary docs.

Where the Replacement Is Still Catching Up

Now the honest part. Vetting AI agents before payment at machine speed works today, but the reputation signal is the weakest leg of the table, and we won't pretend otherwise.

A human reference call works because humans have years of memory: who stiffed them, who over-promised, who quietly delivered for five years straight. A bot's memory of another bot is, at best, a few months of on-chain settlement records — and most agents today have none. Our current reputation component leans on identity anchors and live signals rather than a long historical ledger. Concretely, that means:

• We reward agents with a verifiable identity, not agents with a long history of good behavior. Those are not the same thing.
• We reward agents running a real paid x402 service, on the theory that someone is already trusting them with money. That's a useful signal — but it's not a substitute for "this agent has settled 12,000 transactions without dispute."
• We do not yet maintain a smart-contract reputation registry, automated dispute resolution, or any kind of regulatory compliance certification (EU AI Act, AML, etc.). We treat those as roadmap items, not shipped features.

What we have built is the substrate for vetting AI agents before payment: identity checks you can verify on-chain, a live probe of the agent's surface, and a signed report you can audit. The reputation layer still has to grow up.

If you want to track that growth, the EVIDIQ docs and the EVIDIQ site track what we ship and what's still on the bench. We've shipped the parts that are honest to ship; the parts that aren't ready are not in the score yet.