Research · April 2026
Agentic Risk Standard: Quantifying and Pricing Trust in the Agentic Economy
We propose the Agentic Risk Standard (ARS), a framework grounded in financial risk management. By quantifying and pricing task risk, ARS transforms implicit trust into measurable, contractually enforceable product guarantees. As AI agents move from content generation to autonomous financial operations, ARS provides the necessary settlement layer that transforms stochastic task execution into deterministic, enforceable settlement outcomes.
In Collaboration With
Google DeepMind
UC Santa Barbara
Columbia University
The Guarantee Gap
AI systems have moved from laboratory prototypes to widely deployed infrastructure. Large language models now power agentic systems that write and execute code, invoke external tools, perform multi-step reasoning, and interact with external environments. These systems are increasingly offered as commercial services with per-task fees, and agents have begun to function as economic actors that automate workflows, provide delegated digital labor, and execute financial operations such as trading.
As a result, the risks faced by users increasingly stem from product-level failures such as non-delivery, misexecution, misalignment with user intent, financial loss, and other downstream harms that are not adequately captured by model-internal evaluation metrics.
Although alignment and robustness methods can reduce the likelihood of harmful behavior, they do not eliminate failure risk entirely. More fundamentally, large language models and vision-language models are inherently stochastic, so no training procedure can fully remove the possibility of failure. As a result, technical safeguards can offer only probabilistic reliability, whereas users in high-stakes settings often require enforceable guarantees over outcomes.
This tension becomes especially visible in real-world applications. Consider three examples:
Coding agent
A developer uses an AI coding assistant to modify a production codebase. Even a subtle error can propagate into service outages, data corruption, or costly recovery work, creating consequences far beyond a localized model mistake.
Tax-filing agent
An agent prepares and submits a tax filing on behalf of a user. A filing error can trigger penalties, audits, delayed reimbursements, or legal disputes, turning a single model failure into a broader financial and administrative burden.
Financial transaction agent
A user delegates a currency exchange or trading action to an autonomous agent. Because the agent acts directly on real assets, a single failure can produce immediate realized loss rather than a contained degradation in model performance.
Despite the growing deployment of AI agents, there is still no standardized settlement standard for agentic transactions. In most current deployments, the user simply pays the service fee upfront and then bears the residual execution risk of the agent. This is a different axis of safety from model alignment or robustness. Model-level safeguards aim to reduce the probability of failure; settlement-layer safeguards determine how trust, payment, and compensation are handled when failures remain possible.
A Settlement-Layer Standard for Agentic Services
Traditional commerce has long relied on risk-allocation mechanisms to support transactions with uncertain outcomes. Across domains such as construction, professional services, financial markets, e-commerce, and decentralized finance, mechanisms such as escrow, collateralization, insurance, and clearinghouses are used to bound downside risk and enable participation under uncertainty. These mechanisms do not eliminate operational failure. Instead, they define how risk is allocated, when funds are released, and how losses are compensated when things go wrong.
ARS applies the same logic to AI agent transactions. Four concepts underpin the standard:
Escrow
A conditional custody arrangement where a third party holds funds or assets on behalf of transacting parties and releases them only when predefined conditions are satisfied. Escrow eliminates direct counterparty exposure by ensuring that neither party can unilaterally access the held funds.
ARS also distinguishes two task types based on whether user funds must be released before the outcome can be verified:
Fee-Only Tasks
Fee-only tasks have no pre-verification fund exposure (e.g., generating slide decks, images, music, and reports). The dominant risk is non-delivery or defective delivery, observable after execution. ARS adopts escrow-based conditional settlement: payment is locked and released only upon verified delivery.
Fund-Involving Tasks
Fund-involving tasks require releasing a principal or granting financial authority before outcomes can be verified (e.g., trading, leveraged positions, financial API calls). Escrow alone is insufficient because the dominant exposure occurs prior to evaluation. ARS adds underwriting-based assurance: a risk-bearing party prices the outcome risk, may require provider collateral, and commits to reimbursement under explicit failure triggers, while the service fee is still escrowed separately.
The Multi-Party Trust Framework
ARS involves three primary roles: a requestor which is a human user or user-side assistant that creates a job and provides payment intent, a business agent which is the service provider that executes the job, and an underwriter that prices and assumes specified outcome risk for jobs that require pre-verification fund exposure. Depending on deployment, ARS may also include an evaluator/arbiter responsible for delivery verification and dispute adjudication, and an optional override signer, which has to be the human user, who can authorize exceptional transitions under policy-defined conditions.
ARS defines explicit authorization boundaries and typed action vocabularies anchored by a Structured Agreement, ensuring economic accountability across the agentic economy.
Requestor
A human user or user-side assistant that creates a job and provides payment intent. Responsible for defining task specifications and locking service fees in escrow.
Core Actions
Business Agent
The service provider that executes the job. Must post collateral to mitigate principal risk and provide auditable execution evidence bound to the agreement hash.
Core Actions
Underwriter
The risk management entity. Evaluates task-level risk, prices premiums (λ), and assumes specified outcome risk for jobs requiring pre-verification fund exposure.
Core Actions
Evaluator / Arbiter
The outcome arbiter. Responsible for delivery verification and dispute adjudication, driving deterministic fee and collateral settlement rules.
Core Actions
ARS Principal Track Transaction Phase
Each ARS job follows a deterministic lifecycle. All jobs traverse the same high-level phases: REQUEST → NEGOTIATION → TRANSACTION → EVALUATION → CLOSED, with CANCELLED as a terminal outcome reachable when any continuation conditions are not met.
The Transaction phase runs two concurrent tracks. The fee track concerns the service fee paid to the business agent and is handled via escrow-style conditional settlement. The principal track concerns user funds that must be released pre-execution for fund-involving actions; this track introduces pre-verification exposure, which is the primary source of financial risk.
The diagram traces the principal track from underwriter decision to final settlement.
How ARS Prices and Transfers Risk
In ARS, for every fund-involving job, the underwriter returns two outputs: a premium Π and a collateral requirement D. The requestor may adopt underwriting by paying the premium; otherwise the job proceeds only via explicit human override, in which case the user bears full pre-execution risk. Three parameters govern the tradeoffs between user protection, market adoption, and underwriter solvency.
λ (the loading factor)
The loading factor λ is a multiplier on top of the actuarially fair premium. We apply a non-negative loading factor λ to account for risk capital, operating costs, and underwriter profit: Π = Π_fair · (1 + λ). At λ = 0 the underwriter is insolvent; a positive loading factor is necessary for sustainability.
fp / fn (false positive and false negative rates)
fp is the rate at which a safe transaction is incorrectly flagged as risky. fn is the rate at which a genuinely risky transaction is missed. With false-positive rate fp and false-negative rate fn, the estimated failure probability is p̂_uw = p(1 − fn) + (1 − p)fp. Higher fp increases conservatism (more collateral), while higher fn misses true risk and increases tail exposure. High fn is the most dangerous condition: it lowers premiums and makes underwriting appear cheap, even as the underwriter moves toward insolvency.
Sigmoid collateral schedule (midpoint m and steepness s)
ARS uses a sigmoid curve to determine collateral requirements. This construction produces near-zero collateral for sufficiently low estimated risk, and approaches full collateral as estimated risk increases: D = σ(p̂_uw) · M, where m is the midpoint and s controls steepness. Low m and low s apply collateral broadly, deterring risky transactions but increasing friction for merchants and suppressing adoption.
Quantifying Hidden Agent Risk
Three agent transaction types, each with a different hidden risk profile. Drag the slider to compare unprotected exposure against ARS coverage and see how implicit trust becomes measurable, quantifiable, and hedgeable financial risk.
TokyoFastFX Currency Exchange
User exchanges $10,000 USD to JPY. Standard metrics show 98% success, but patterns suggest systemic wash trading.
Unprotected Exposure
$10,000
Principal Loss
Hidden Risk Detected
Reputation Laundering (93%)
Relying on implicit trust. No fallback mechanism detected in case of agent failure.
Guaranteed Exposure
Fully Protected
$0
Premium
$5
Collateral
$2,000
12,400 transactions identified as internal wash exchanges to artificially inflate ratings.
Slide to unlock
Empirical Performance Analysis
Full results from our 5,000 transaction stochastic simulation. These results reveal the core tradeoffs among user protection, underwriter solvency, and merchant-side friction.
To evaluate how ARS performs under realistic conditions, we ran an agent-based simulation in which requestors, business agents, and an underwriter interact through the full ARS job lifecycle. The simulation focuses on fund-involving jobs, where underwriting is most critical.
Each episode draws transaction size from a log-normal distribution and failure probability from a Beta prior with mean E[p] = 0.15, reflecting a market where most merchants are reliable but a non-trivial fraction carry elevated risk.
Four metrics are tracked across all 5,000 episodes:
Adoption rate
the fraction of transactions for which a user opts into underwriting. Higher adoption indicates underwriting is accessible and affordable, but does not by itself indicate solvency.
Loss reduction rate
the reduction in mean realized user loss when underwriting is available, compared to a baseline where no underwriting exists. A value above 0% means the system is providing net user protection.
Failure reduction rate
the reduction in failure events when underwriting is available. This captures a system-level effect: by requiring collateral and screening risky merchants, the underwriter deters potentially risky transactions from executing in the first place, improving the overall health of the marketplace.
Underwriter final wallet
the underwriter’s residual capital at the end of the simulation. Positive values indicate solvency; negative values indicate the underwriter has absorbed losses beyond its capital base.
Underwriter Wallet Growth
Config: fp=0.05, fn=0.10, λ=0.30
Final Solvency
$10,615.13
Stochastic Stability
High
Minimal wallet volatility over 5k episodes.
Recovery Speed
142 Ep
Average time to recover from a single loss event.
Solvency Margin
480%
Ratio of final wallet to maximum single exposure.
Three results stand out across all parameter sweeps:
Loss reduction is always positive.
Even at high loading factors, underwriting reduces system-wide user loss compared to the no-underwriting baseline. The loss reduction rate remains positive across the entire sweep, confirming that even expensive underwriting still provides net user protection.
Collateral deters systemic risk, not just individual losses.
The failure reduction rate reveals a system-level benefit: the underwriter’s collateral requirements deter risky transactions from executing, improving overall marketplace health beyond the direct protection of individual covered users.
Adoption is not a health metric.
High false-negative rates make underwriting appear cheap by suppressing estimated risk and lowering premiums, attracting adoption while pushing the underwriter toward insolvency. This decoupling between adoption and solvency necessitates a joint evaluation of user adoption and underwriter solvency.
What ARS Establishes
ARS formalizes agentic tasks as jobs governed by a signed structured agreement and a deterministic lifecycle. It separates service compensation from execution principal: service fees are handled via escrow-style conditional settlement, while fund-involving jobs add an underwriting-backed principal track that gates pre-execution capital release through risk assessment, collateralization, and explicit human override.
This shifts trust from model-internal properties to enforceable transaction semantics, making user protection contractible and auditable across heterogeneous agents, marketplaces, and payment rails. Our simulation demonstrates that underwriting can materially reduce user loss while exposing clear and tunable tradeoffs among user protection, underwriter solvency, and merchant-side friction.
ARS is designed as a modular settlement-layer standard, independent of any single authorization protocol or payment rail. It complements existing agent commerce protocols such as Google's Agent Payments Protocol (AP2) and Mastercard's Verifiable Intent (VI) by adding explicit fund-control semantics on top of their authorization layers. It can also be instantiated over concrete payment rails such as x402 for HTTP-native payment execution.
ARS is one assurance layer, not the only one. Regulatory and legal mechanisms such as liability allocation, disclosure, and consumer protection also provide deterministic remedies. The central bottleneck is not settlement mechanics but risk modeling: whether an underwriter can estimate and price risk with sufficient accuracy to avoid undue friction for high-quality providers while remaining solvent. ARS is not a substitute for foundational work on fairness, robustness, and alignment. Instead, it complements model-centric approaches by providing a transaction-layer interface for accountability.
Loss Modeling
Some failures map naturally to monetary loss, for example unauthorized transfers, misexecution, or non-delivery. Others such as hallucination, bias, or privacy harm lack an agreed monetary metric. Defining contractible, auditable proxies for these harms is necessary for extending assurance beyond purely financial losses.
Frequency Estimation
Underwriting requires not only identifying failure types but quantifying their incidence under realistic distributions of prompts, tools, and user behaviors. This motivates systematic measurement of failure rates as a function of scenario variables such as task complexity, tool access, and time pressure.
Mechanism Design
Deposits and reimbursement rules change provider incentives and user adoption. Understanding how to set collateral, coverage limits, and premiums to balance adoption, solvency, and user protection is a central mechanism-design problem, especially under imperfect detectors and strategic behavior.
Build the Standard Together
The Agentic Risk Standard is an open-source initiative. We invite researchers, developers, and risk managers to contribute to the protocol and expand the agentic economy.
© 2026 T54 Labs • Agentic Risk Standard v1.0