Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering

Programmable-payment protocols such as x402 enable per-request micropayments, but they do not determine which payable service an autonomous agent should buy under a finite wallet. We formulate this buyer-side problem as agent-native payment decision-making: contextual provider selection under wallet pressure, chosen-only paid feedback, and changing market conditions. We propose 402Pilot, a protocol-agnostic buyer-side decision layer between autonomous agents and payment execution that implements purchasing policies for selecting among payable providers. We instantiate it with PA-DCT, a payment-aware discounted contextual Thompson-sampling policy that adapts purchasing decisions under wallet pressure while learning from post-payment feedback. To evaluate buyer-side payment policies, we introduce 402Pilot-Bench, a frozen-replay benchmark spanning 823 tasks, five heterogeneous provider pipelines, and three market regimes, each evaluated over 30 paired seeds. PA-DCT achieves the strongest fixed-wallet adaptive trade-off among non-oracle policies: it maintains competitive service quality while spending only 39 to 43 percent of the wallet and reallocates spending as market conditions change. It attains the best non-oracle PA-gap/T under the price shock and the best mean and worst-case ranks across the nine scenario-metric combinations of quality, ROI, and PA-gap/T. Comparisons with learning baselines and component ablations further support the effectiveness and design of the proposed decision policy. These results suggest that programmable payment must be complemented by buyer-side decision-making capable of learning service value and adapting purchasing decisions accordingly.

In LLM agent pipelines, prompt privacy risk propagates beyond a single model call: raw user content enters retrieval queries, memory writes, tool arguments, OCR-derived text, and logs, and every downstream copy inherits what the first write contained. Existing de-identification pipelines protect document boundaries but not this cross-stage surface. We present BodhiPromptShield, a policy-aware mediation layer that detects sensitive spans before they propagate, replaces each with a typed placeholder, a semantic abstraction, or a secure symbolic token under a configured policy, and defers restoration to authorized execution boundaries. We evaluate it under one protocol against Presidio, Casper-style sanitization, an LLM sanitizer, and transformer and learned detectors, on 300 AI4Privacy documents, 493 PrivacyLens trajectories, 200 PrivacyLens tasks scored by that benchmark's own judge, and AgentDojo tasks under injection. Three findings result. Identifier propagation is controllable: residual exposure falls to 7.4% on AI4Privacy and 1.8% on PrivacyLens, and exact identifiers in an agent's final action fall from 13.7% to 2.1-3.1%. Restoration timing governs what every stage upstream of the authorized boundary sees: deferring it leaves 1.6% of protected values readable in the released context against 51.0%, and 2.7% against 4.8% in what the agent emits, for 0.11 helpfulness points. Measuring factual disclosure is harder: a word-overlap metric and an LLM judge both report that mediation leaves facts intact, and both disagree with blind human annotation (kappa = 0.25 and 0.09). The human labels reverse that: inferability falls from 100% to 24-53% under mediation, so semantic-leakage measures need human validation before they are trusted. These are systems results on English text with open-weight models, not formal guarantees.

Agentic payment systems extend delegated action to financial transfers, but scaling them on stablecoin rails in regulated settings requires safeguards that remain effective when humans are not continuously in the loop. We present a compliance-aware architecture that combines x402-style, signature-based payment authorisation and relayed execution with programmable compliance embedded as an on-chain guardrail via a policy wrapper and policy manager coordinating modular checks. By enforcing compliance at the point of execution, rather than as a separate off-chain workflow, the approach preserves low-friction settlement when conditions are satisfied, records transaction-linked on-chain attestations, and supports structured resolution when requirements are pending.