A native, verifiable trust layer for agentic payments

Tether is quietly building the rails for the agentic economy

If you have been watching Tether over the last year, the direction is hard to miss. They are not a stablecoin company that happens to dabble in AI. They are building the infrastructure for an economy where software agents and machines transact on their own.

It started with WDK, the Wallet Development Kit: a self custodial, agentic wallet that lets software hold and move Bitcoin and USDT without a custodian sitting in the middle.

Then came QVAC, Tether's local first, peer to peer AI platform. QVAC runs models and agents directly on your own devices instead of someone else's data center, and it wires payments straight through WDK. So an agent running on your phone or your laptop can transact autonomously in Bitcoin and USDT, with no cloud and no gatekeeper.

And most recently, Tether stepped in to lead the latest funding round for NEURA Robotics, a humanoid robotics company. The part that matters for us is what it says about the wallet: per Tether's announcement, the deal includes integrating WDK into NEURA's robots, so a humanoid can carry its own self custodial wallet and pay or get paid in Bitcoin and USDT, machine to machine, on behalf of its operator and within set parameters.

Put those three together and the bet is clear. Tether thinks the next wave of users is not only humans. It is agents and machines, and WDK is the wallet they will carry.

What probably gained less attention

In the same week as the robotics news, the WDK team merged something quietly into the kit itself that we think is just as important.

That something is their Phase 1 local transaction policy engine (PR #55). It lets a wallet check a transaction against scoped conditions and deny it before it is ever signed.

That merge is a bigger deal than it looks, and not only for Tether. A local policy hook is exactly what lets a complete trust layer sit natively on top of WDK. Which is what Observer Protocol builds.

We do not bank, custody, or settle. WDK does that. What we add is the trust layer around it: who the agent is, what it was authorized to do, and a portable, portable, signed record of every decision. With that engine in place, that layer now plugs straight into WDK's own engine.

Meet Maxi, an agent with an identity you can check

Before the demo, meet Maxi.

Maxi is an autonomous agent with something most agents do not have: a real, portable identity that anyone can verify. She has been verified since February 18, 2026, and her whole profile is public.

The point is that none of this lives inside one company's walls. It is hers, it is signed, and anyone can check it without asking us.

The demo: our trust module, running on WDK's own local transaction policy engine

Here is what it looks like when the two fit together. One real agent mandate (Maxi, capped at 100 USDT, only to the allowlisted merchant), WDK's real local transaction policy engine, and a real wallet key. Two transactions, run end to end.

The first transaction is within the mandate: 50 USDT to the allowlisted merchant. The policy engine allows it. The wallet key signs it (a real signature, not broadcast). And then the part only Observer Protocol does: our evaluator independently evaluates the same mandate and issues a signed PolicyEvaluationCredential, bound to that exact transaction and to that exact mandate, and it re-verifies against our live public endpoint. That credential is a portable record of exactly what was authorized, and any counterparty can verify it independently. A wallet-local engine cannot produce that.

The second transaction is over the line: 150 USDT, past the 100 USDT ceiling. The engine denies it at the signing boundary, and the signer is never invoked. Nothing was signed, so there is nothing to prove and nothing to undo. And because Observer Protocol pairs every allow with a mandatory deny, the refusal fails closed instead of open.

That is the whole idea. WDK's wallet moves the money. The engine enforces the policy. Observer Protocol is what turns every authorization into a portable, portable, signed record, and what makes sure a refusal at the key is provable.

1. Verify the record. Here is the signed credential from that run. Verify it yourself. This one line fetches the hosted PolicyEvaluationCredential and checks it against our public verify endpoint:

curl -s https://api.observerprotocol.org/api/v1/verify \
  -H 'content-type: application/json' \
  -d "{\"credential\": $(curl -s https://observerprotocol.org/credentials/maxi-0001-wdk-demo-pec.json)}"

It returns {"signature":true,"not_expired":true,"not_revoked":true}. The credential is hosted at observerprotocol.org/credentials/maxi-0001-wdk-demo-pec.json. And you do not even need our endpoint: it is a standard eddsa-jcs-2022 Data Integrity proof that verifies with the reference W3C Data Integrity libraries against our published DID at observerprotocol.org/.well-known/did.json. That signed, portable record is the part a wallet-local engine cannot produce.

2. Reproduce the enforcement. The core enforcement runs in your own terminal, against WDK's real local transaction policy engine, with no Observer Protocol infrastructure in the path:

# the OP ALLOW + DENY pair on WDK's real local transaction policy engine
git clone https://github.com/observer-protocol/wdk-op-policy
cd wdk-op-policy && npm install && npm run verify

You will watch an in-mandate payment allowed and a payment over the ceiling blocked before the key is ever reached.

What this is, stated plainly

Issuance is live. Verification of this credential type is not. The record is signed, and its eddsa-jcs-2022 proof is sound against our published DID document under canonical W3C Data Integrity tooling — that much anyone can check with libraries that are not ours. What does not exist is a verifier for a PolicyEvaluationCredential, anywhere, including ours: not in the published @observer-protocol/policy-engine, not in the hosted service, and not in the schema set. This page previously called the record “independently verifiable” and pointed at our own endpoint as the check. That was the opposite of independent, and it is corrected here rather than qualified. The full disclosure →