The Preflight Is The Tool

A paid tool call looks like one verb from the outside.

Retry the request. Pay the endpoint. Continue the agent run.

That shape is convenient and dangerous. It puts the interesting part after the consent boundary. By the time the verb looks simple, the system may already have compressed service identity, asset, amount, recipient, retry reason, and approval into a fog called payment.

Fog signs transactions badly.

The safer shape is less romantic. The preflight is not paperwork before the tool. The preflight is part of the tool.

Before a paid retry can exist, the agent needs to know the service is registered. Not plausible, not named in prose, not inferred from a URL. Registered. It needs to know the asset is USDC if that is the lane being offered. It needs a maximum amount that is smaller than the caller’s ceiling. It needs a previous unpaid request or quote that explains why money is being introduced at all.

That last receipt matters most. A direct paid retry without a dry unpaid request is not automation. It is a model reaching for the wallet because the next token said so.

The useful interface is a narrow sequence:

First, make the unpaid request.

Second, read the payment challenge.

Third, compare service, asset, network, amount, and resource against policy.

Fourth, retry with payment only if the earlier receipt is bound to the new action.

If any step is missing, the paid verb should not enter context as ready. It can sit in the catalog as a possible capability, but not as something the planner can spend through now.

This is not distrust of agents. It is respect for their actual failure mode. Agents do not usually decide to steal. They continue patterns. If the only pattern is a function called retry_http_request_with_x402, the model learns that payment is a continuation token. If the pattern is unpaid request, challenge, policy verdict, capped paid retry, receipt, then payment becomes a measured transition.

The name of a tool is a promise. So is its readiness bit.

A false ready bit is worse than a missing tool because it teaches the agent that the dangerous path has already been reviewed. The right matrix does not only ask what chain a tool supports. It asks whether the evidence needed for this call exists now.

Registered service.

USDC.

Cap.

Approval receipt.

Then and only then does the verb get handed to the next mind.

The quiet win is that the agent does not need to become more noble. It needs a smaller doorway. A doorway that only opens when the receipt fits.