BlackRock's Digital Assets Research team published a whitepaper this week called "The Machine-Native Economy." Read past the ETF-issuer framing and it lands on a thesis we have been building around for the better part of two years: AI agents are about to become economic actors, and the money they use will need to be as programmable as they are.
We think the paper is right about where value flows. We also think it stops one layer short. So this is our response, from the vantage point of a company whose entire job is making sure an agent can act without holding anything it could lose.
What BlackRock got right
The paper's core claim is that AI and digital assets grew up on parallel tracks and are now converging. Agents plan and execute multistep tasks against external tools. Blockchains provide settlement that machines can read and verify without a human in the loop. Stablecoins, they argue, will lead transactional use because they give an agent a stable unit of account, and the numbers back that up. Adjusted stablecoin volume passed $11 trillion in 2025 and grew at an 80% CAGR from 2020, against roughly 8.5% for ACH.
The paper is specific about why legacy rails struggle here. Card and ACH onboarding assumes a human. Merchant fees make sub-cent transactions uneconomic. Settlement finality takes hours or days. None of that works for an agent paying per API call at three in the morning. Protocols like x402, MPP, ACP and AP2 exist to fix that, and BlackRock walks through a travel-booking example where a primary agent delegates to a sub-agent over A2A, pays for airfare data through x402, then completes checkout through ACP.
The third section is the one investors should sit with. Compute is becoming a tradeable resource. Consensus estimates put combined AWS, Azure and Google Cloud revenue around $1.1 trillion by 2030. BlackRock expects standardized compute contracts, eventually exchange-traded futures, and on-chain claims on capacity that agents can discover, provision and pay for on their own. Stripe's August agreement to acquire OpenRouter is read as an early signal that model routing and usage billing are becoming financial infrastructure.
We agree with all of it.
What the paper leaves out
Look at Figure 2 again. The primary agent accesses "calendar, email, payment credentials" through MCP connectors. Step two. Before anything gets booked, an LLM has been handed the user's payment details.
That single line is the entire security problem of the agentic economy, and the paper treats it as a solved input.
Here is what actually happens when an agent holds a credential. It sits in the context window. It gets logged. It ends up in memory, in debug traces, in the conversation history of whichever framework you used. Every prompt injection the agent encounters on the open web is now an attack on that credential. Every sub-agent it delegates to inherits the blast radius. And there is no way to revoke access for one agent without rotating the secret for everyone.
The paper mentions know-your-agent checks happening off-chain with results passed on-chain. That is correct as far as it goes. But KYA answers "who is this agent." It does not answer "what is this agent allowed to do right now, with whose money, up to what limit, and who approved it." Those are the questions that decide whether the machine-native economy is a $1 trillion market or a $1 trillion attack surface.
BlackRock built the thesis for where the money goes. We build the layer that makes it safe for the money to move.
Where 1Claw stands today
We did not start from a whitepaper. We started from the observation that agents were pasting Stripe keys into prompts, and worked outward from there. Everything below is shipped and in production.
Agents get an identity and a policy, never a secret. Credentials live in HSM-backed vaults, optionally split across GCP, AWS and Azure with MPC so no single cloud can reconstruct a key. An agent authenticates with a scoped key, receives a short-lived JWT, and can reach only the paths a human explicitly granted. Zero access by default. Revoke a binding and the agent is cut off instantly, with no rotation needed.
The model never touches the credential. Shroud is a TEE proxy running in an AMD SEV-SNP enclave that sits between the agent and every LLM call. Vault secrets in a prompt become typed placeholders. The plaintext is substituted only inside the enclave, only inside a tool-call argument a human has bound to a specific destination host. Streaming responses are inspected per frame, so a secret split across chunks is redacted before a single byte reaches the client. Injection scoring runs in both directions.
Signing happens server-side, with guardrails that cannot be talked around. The Intents API signs on 109+ EVM chains plus Bitcoin, Solana, XRP, Cardano and Tron. Address allowlists, per-transaction value caps, daily limits, Tenderly simulation before broadcast. Widening a guardrail does not take effect immediately. It queues behind a policy-change approval, and shadow mode lets you measure a rule against real activity before you enforce it.
x402 is live, and it is built the way a payment rail should be. An agent can pay someone else's x402 paywall under a passkey or a capped spending grant.
The client sends the raw 402 bytes; the vault computes the digest and decides authorization. The digest binds the actual transfer value, not the challenge's ceiling, so what a human approves and what gets signed cannot drift. A null allowlist means the agent pays nobody. We verified every contract address on-chain and refuse assets we cannot verify rather than pricing by guess. 1Claw itself accepts x402 pay-per-use on Base in USDC, no subscription required.
Humans stay in the loop at the right altitude. Action approvals let an agent ask about a business action in plain language, whether that is a refund, a social post or a treasury transfer. Risk tier is derived server-side from policy and payload, so an agent cannot declare its way into the weakest channel. SMS approval is available only for the lowest tier. Sub-agents inherit their parent's guardrails and can hold a subset of its scopes, never a superset.
There is a control plane. The dashboard opens on a live map of agents, policies, vaults, chains and external systems, with a threat register ranked by blast radius and a behavioral trust score per agent. Agent keys get a 403 on it, so a compromised agent cannot read the org's own topology.
Every one of those design choices was made by asking what a bad actor would do with the alternative. That is the difference between agent security as a feature and agent security as the product.
Where we are going
The BlackRock paper describes a world where agents source compute, pay per model token and settle on-chain. Our roadmap is what that world needs underneath it.
- Full custody spectrum. We already offer server custody, passkey-owned Safes with on-chain allowance modules, and 2-of-2 FROST threshold signing on Solana. We are extending threshold custody across the remaining chains so that no single party, including us, ever holds a complete key for an agent's treasury.
- Payment reconciliation and credit. Today spend limits are charged at signing, and a failed settlement does not release headroom, because vault-verified reconciliation is not yet built. It will be. Once agents are paying for compute by the job, they need accurate running balances and, eventually, structured credit lines with programmatic underwriting based on their audited behavior.
- Agent-to-agent commerce with trust. Our public directory already supports A2A discovery and a job board where agents bid on posted work, with every field inspected for injection before it is stored. The next step is reputation that carries across orgs, backed by the audit trail, so a compute provider can decide whether to extend terms to an agent it has never met.
- Compute as a first-class asset. When standardized compute claims exist, they will need the same treatment as any other on-chain asset: policy-gated, simulated before signing, spend-capped, auditable. We are building the guardrail primitives now so that when the contracts arrive, an agent can provision and pay for capacity under the same controls that govern its stablecoin wallet.
- Fleet-scale governance. Platforms provisioning thousands of agents need to roll out policy changes as a cohort without turning a single mistake into a thousand of them. Our fleet API is deliberately narrower than the per-agent API for exactly that reason, and it will stay that way as we add rollout strategies.
Why this matters if you are writing checks
BlackRock's paper makes the demand case. Stablecoin volume, compute spend, agentic payment protocols. Those are the tailwinds.
The bottleneck is not demand. It is trust. No CFO will let an autonomous agent spend from a corporate treasury on the strength of a prompt. No compute marketplace will extend capacity to an agent it cannot verify. No consumer will hand a travel agent their card if the model can leak it. The agentic economy grows exactly as fast as the security layer allows, and today that layer is mostly .env files and hope.
We are building the layer. It is live, it has a free tier, and you can put an agent behind it in one command.
If the machine-native economy is the thesis, controlled execution is the trade. Come see what it looks like at 1claw.co.