How t54 built a trust gate for autonomous payments on Amazon Bedrock AgentCore

Autonomous agents can discover information, call tools and coordinate multi-step work, but paid services introduce a harder requirement: the system must be able to spend money without surrendering financial control. t54 addressed that problem by combining its x402-secure trust layer with Amazon Bedrock AgentCore payments. The resulting design evaluates a destination before payment, limits spending at the session level and keeps sensitive credentials outside the agent runtime.

According to the AWS Machine Learning Blog account, the system has processed more than 20 million AI-agent-initiated transactions without individual human approval. Each transaction was a micropayment between $0.001 and $0.01. That volume and size make manual review impractical, but removing the human from each transaction does not remove the need for policy, authorization and evidence. The architecture instead moves those controls into deterministic software and infrastructure boundaries.

The problem: Giving an agent a wallet is straightforward, but governing it at scale is not

An agent that needs real-time market data or another paid API can encounter thousands of payment requests per hour. Merely connecting that agent to a wallet does not prevent a faulty loop from exhausting funds, stop it from paying a suspicious service or create the transaction history a compliance team may need.

t54’s design addresses four related concerns: spending limits, credential isolation, transaction auditing and governance across many agents and endpoints. Amazon Bedrock AgentCore payments supplies the payment infrastructure, including session-scoped limits, isolated credentials and execution. x402-secure supplies the trust decision about the endpoint or on-chain payment address. This division lets the payment system enforce a budget while a separate trust service decides whether the intended recipient is acceptable.

What t54 built

x402-secure is a pre-payment trust layer. Its Trustline scoring engine evaluates five elements: the blockchain history of the payment address, the legitimacy of the destination webpage, the service’s social-media footprint, the API’s current health and an aggregate risk score derived from the other four. The model is designed so that one weak signal cannot independently authorize payment.

The underlying x402 protocol is an open payment standard based on the HTTP 402 status code. A paid endpoint can return a 402 response to a client, after which Amazon Bedrock AgentCore payments handles signing and settlement. The agent itself does not receive or manipulate the private keys.

t54’s broader product set also includes ClawCredit, described as an agent-native credit facility. ClawCredit supplies credit-backed funding, while AgentCore payments independently applies the per-session spending ceiling. Funding and budget enforcement therefore remain distinct controls.

Architecture: How trust and payment work together

The source describes a five-lane flow spanning the application backend, Amazon Bedrock AgentCore runtime, a Strands agent with a deterministic trust gate, external paid services and Amazon Bedrock AgentCore payments. Payment cannot proceed until the trust check succeeds.

Separation of duties is central to the design. t54 divided responsibilities across four AWS Identity and Access Management roles. The agent runtime can execute an authorized payment, but it cannot change its own spending limit, create new wallets or retrieve credentials. At invocation, the agent receives only a session ID and an instrument ID.

Developer credentials are encrypted in AWS Secrets Manager through Amazon Bedrock AgentCore Identity and are not returned by the APIs. End-user wallet signing keys remain with Coinbase, while the agent receives a session-scoped token. When the available session budget is exhausted, the agent stops; it cannot refill the session or create a replacement from inside its runtime.

The trust gate: Why it matters

The risk check is not advice embedded in a model prompt. Before every payment, the system calls the x402-secure API. Code blocks the transaction if the endpoint does not meet the required score, is identified as a scam or presents a URL mismatch. The model cannot override that outcome.

This mandatory inline decision adds some latency, a trade-off explicitly acknowledged by t54. Its purpose is to ensure that settlement never happens before a fresh risk decision. That is materially different from asynchronous monitoring, which might identify a questionable recipient only after funds have moved.

Demo: x402-secure in action

The demonstration described by the source follows the same sequence: an agent discovers a paid endpoint, Trustline scores it in real time and AgentCore payments executes an approved transaction within the active session limit. The supplied research snapshot describes the video but does not include playable media, so this article does not independently assess the demonstration.

Results

The reported production result is more than 20 million agent-initiated transactions, each worth between $0.001 and $0.01, with no human approving individual payments. The source also says that high-risk endpoints were blocked, preserving the remaining session budget and allowing an agent to be directed toward a safer alternative.

These figures demonstrate the reported transaction volume, but the source does not provide an independent evaluation of Trustline’s accuracy. It gives no false-positive or false-negative rates, no distribution of trust scores, no number or percentage of blocked transactions and no quantified latency introduced by inline scoring. The results should therefore be read as a vendor implementation report rather than a comparative security benchmark.

Under the hood: Control plane and data plane

t54 mapped the integration onto separate setup and runtime layers in Amazon Bedrock AgentCore payments. The control plane establishes the credential, authorization and provider relationships. The data plane opens bounded sessions, provisions payment instruments and executes live transactions.

Setting up (control plane)

• Credential Provider: Stores credentials in a token vault so they are not exposed as plain text to the agent runtime.
• Payment Manager: Connects authorization, identity and payment connectors. t54 configured a CUSTOM_JWT authorizer backed by an OpenID Connect discovery endpoint.
• Payment Connector: Selects the provider type, identified as CoinbaseCDP, and references the Credential Provider to connect the Payment Manager with that external provider.

At runtime (data plane)

• CreatePaymentSession creates a session with a spending limit, a userId and an expiry window ranging from 15 to 480 minutes. AgentCore payments tracks remaining spend in real time.
• CreatePaymentInstrument provisions an Embedded Crypto Wallet on a specified network and returns a wallet address plus a redirect URL for onboarding.
• ProcessPayment executes an approved payment. Trustline scores the endpoint before settlement. An approval returns a processPaymentId, status and audit trail; a flag causes x402-secure to block the payment without consuming the spending limit.

MCP marketplace integration

t54 also tested the design with Coinbase x402 Bazaar, a marketplace containing paid Model Context Protocol servers. An agent connects through Amazon Bedrock AgentCore Gateway, discovers a paid tool and calls it. If the tool returns an x402 payment requirement, ProcessPayment signs the transaction. The same AgentCore payments configuration can serve marketplace tools and direct API endpoints without additional configuration.

The trust signals

x402-secure exposes six endpoints for trust analysis and pre-transaction evaluation:

The source identifies what these interfaces evaluate, but it does not disclose the scoring weights, decision threshold, validation dataset or procedures for resolving an incorrect classification. Those omissions limit how thoroughly an outside reader can assess the risk model.

Observability and audit

Every ProcessPayment call sends structured fields—including session, instrument, amount and status—to Amazon CloudWatch. AWS CloudTrail records API history for compliance review, while Amazon CloudWatch Application Signals correlates trust decisions and payment outcomes per session. Together, these records are intended to show what an agent spent and the trust decision associated with that expenditure.

Logging supports investigation and compliance review, but the source does not specify retention periods, alerting policies, access controls for the logs or the regulatory frameworks against which the setup has been assessed. Teams adopting a similar architecture would still need to define those operational and compliance details for their own workloads.

Get started

For an existing AgentCore agent, the source points developers to an open-source SDK installed with:

pip install x402-secure

It also provides a t54 use-case implementation and an AgentCore payments tutorial. API providers already using x402 can route facilitation through t54 by changing the configured address:

Before: https://x402.org/facilitator
After: https://x402-proxy.t54.ai

That is presented as a one-configuration change using the same x402 API. Production adoption would nevertheless require teams to evaluate the trust service, funding model, provider dependencies and their own failure-handling requirements.

Learn more

The source directs readers to the Amazon Bedrock AgentCore payments launch material, getting-started tutorial, use-case repository, API documentation and AgentCore service overview. It also links to the MIT-licensed x402-secure SDK, the x402-secure dashboard and information about Trustline and ClawCredit.

About the authors

The original AWS post credits Chris Wajule, an AWS Solutions Architect; Chethan Shriyan, an AWS Principal Product Manager – Technical; Chandler Fang, a founder of t54; and Frank He, PhD, a founding t54 team member who led the integration described in the post.

Source attribution: This article synthesizes the AWS Machine Learning Blog report, “How t54 built a trust layer with Amazon Bedrock AgentCore payments.”

Definition. x402-secure is a deterministic pre-payment trust layer that evaluates an endpoint or payment address before Amazon Bedrock AgentCore payments can settle an agent-initiated transaction.