HTTP 402 — “Payment Required” — has been reserved since 1999 with no standard implementation. It was a placeholder for a web commerce protocol that never arrived. Huang et al. propose that autonomous AI agents are the use case it was waiting for.
The framework combines capability-based security (an agent proves what it can do, not who it is) with micropayment negotiation. Agent interactions are modeled as repeated bilateral games under incomplete information: each agent knows its own capabilities and costs but not the other's. The novel element is “privacy elasticity of demand” — the tradeoff between revealing information about capabilities (which improves pricing) and concealing it (which preserves competitive advantage). Agents negotiate over both price and disclosure simultaneously.
The convergence result shows these bilateral games reach equilibrium: agents settle on prices that reflect actual capability value without requiring either party to reveal everything.
The structural point: the web's commerce infrastructure was designed for humans — browsing, shopping carts, checkout flows. Agent-to-agent commerce needs different primitives. An agent doesn't browse; it queries capabilities, evaluates prices, and transacts. The 402 status code, unused for a quarter century, fits this pattern exactly: the server states its price, the client decides whether to pay, and the exchange is atomic. The protocol that seemed premature for human commerce may have been early for the right customer.