When machines become the customer

>_GET /blog/internet-for-agents

A procurement task lands somewhere in a mid-sized company: find us a workflow tool with SOC 2, EU data residency, under 3,000 EUR a month. Nobody opens a browser. The task goes to Blake, the company's buying agent, and within a quarter of a second Blake has queried the registries, pulled 214 candidate manifests, rejected 211 on hard constraints, and opened conversations with three finalists. No landing page was seen. No demo was booked. And somewhere in that quarter second, a vendor with a beautiful website and no machine-readable surface lost a deal it never knew existed.

The previous post made the general claim: the web is becoming a layer of verifiable declarations between representatives of interests. This post slows that quarter of a second down, following the first and densest archetype, B2B software bought by an agent, closely enough to see the machinery. It is where the trust stack>_Trust stackIdentity → manifest → fit → pricing → sandbox → reputation — infrastructure replacing persuasion.defined in The internet of representatives → is most developed, and where the rest of the series lives.

The agent internet arrives through the side door: businesses adopting agents for narrow, expensive work (research, vendor evaluation, procurement, integrations, support). Once an agent is useful enough to do that work, it starts buying on behalf of the company: SaaS seats, data, compute, APIs. That changes the basic question behind a company website. If the product is increasingly evaluated by agents, what should be "on the page", and does a page in the current sense still matter at all?

Once an agent evaluates the product, the page is not mainly for eyeballs. It has to reduce uncertainty for someone who may never read it. Blake and Sam meet first; the rest follows from that.

Two agents at the table

We met Blake and Sam at the end of the last post: Blake is the buyer's agent (mnemonic B = Buyer), acting on behalf of its principal with a mandate to evaluate and buy; Sam is the seller's agent (S = Seller), exposing what Blake needs to verify. Much of the agent economy lives in the tension between those two roles. Here is how each sees the first encounter.

The journey is brutally fast

The buyer journey looks different because it is compressed at the front and never really ends at the back:

1. Discovery. The agent queries registries or capability search directly to find who solves this workflow problem, meets these constraints, and fits this budget.
2. Hard filtering. It rejects most candidates in seconds on compliance, budget, critical integrations, identity, or unsupported use cases.
3. Deep evaluation. The shortlist goes through manifest parsing, fit exchange, pricing, sandbox, and trust checks.
4. Trust verification. It inspects attestations, signatures, reputation, and the history of whether the vendor's past claims survived measurement.
5. TCO and ROI modeling. It calculates license cost plus integration, maintenance, scaling, support, exit cost, and measurable value.
6. Negotiation and contract. Agents exchange quotes, terms, SLA, and signatures within the limits set by their principals.
7. Continuous monitoring. After purchase, the agent keeps measuring. If quality, uptime, freshness, or cost drift below threshold, it starts re-evaluation and may churn automatically.

If you've ever run enterprise procurement, this list is familiar. It is an RFP process: hard requirements, compliance gates, TCO models, vendor scorecards. The steps are not new. What is new is that they run in a quarter of a second instead of a quarter, and for a 200-euro-a-month tool, not just the massive deals that justify weeks of meetings. The discipline of six-figure enterprise buying becomes the default for every credit card transaction.

The front of that journey is the quarter second this post opened with. By the time a human buyer would have finished reading one homepage, Blake has already been through the entire market:

{
  "task": "procure: workflow_automation",
  "constraints": { "compliance": ["soc2"], "regions": ["EU"], "budget_eur_mo": 3000 },
  "candidates_found": 214,
  "rejected": {
    "no_soc2_attestation": 118,
    "no_eu_data_residency": 41,
    "budget_exceeded": 33,
    "missing_critical_integration": 19
  },
  "shortlist": ["did:web:sam.example", "did:web:rival-1.example", "did:web:rival-2.example"],
  "elapsed_ms": 240
}

The back of the journey never really ends. The agent keeps checking uptime, quality, cost, freshness. Loyalty stops being a feeling about the brand and starts being whatever the latest measurement says.

None of this actually removes the human from the loop. For a serious purchase, the principal still reviews the finalists and signs off. The mandate has limits by design. What changes is where the human enters: at the end, choosing among three verified candidates, instead of at the beginning, staring at 214 websites. A vendor that never survives the machine filter never reaches the human at all.

The surface an agent actually reads

A company still needs a human-facing site, but another surface grows beside it: something agents can read, call, verify, and audit. The intro post showed its shape: a machine-readable signed object>_Verified surfaceGET /.well-known/agent.jsonA personal or company site becomes machine-checkable claims instead of a persuasion layer.defined in The internet of representatives → like a /.well-known/agent.json. For a machine it reads like a catalog card: hard parameters, operating limits, checkable claims, and explicit boundaries around where the product stops. The negative space matters as much as the claims, because it lets an agent reject a bad fit in milliseconds.

Seven things one agent expects from another

When Sam exposes that surface, Blake expects seven things. The first five form the sequential layers of the trust stack. Reputation is missing from this list on purpose: Sam cannot publish it, only earn it. The final two, interoperability and machine contracting, run through every transaction.

1. Identity and proof that Sam is really Sam. Before an agent parses a single claim, it needs to know that it is talking to the real counterparty: an authorized agent connected to a real legal entity, a real domain, and a real mandate. That means cryptographic identity, signed delegation, and third-party attestations such as security, privacy, or compliance credentials like SOC 2. If that chain fails, the evaluation stops immediately. Every later claim rests on this layer (Are you really you?).

2. A capability manifest. A vague line like "we help teams move faster" leaves the agent with almost nothing to compute. The useful version is closer to a machine-readable datasheet: what the product does, what inputs it accepts, what outputs it returns, which markets and languages it covers, how fresh the data is, where the limits are, what integrations exist, and where the product explicitly stops. If the agent can reject a bad fit in milliseconds, the vendor has saved both of them time and earned a little trust (The end of landing pages).

3. A fit protocol. The vendor must be able to receive a structured brief: outcomes, must-have integrations, compliance constraints, budget, latency needs, data residency, markets, and weights. A vague "great fit" is useless here; Blake needs a verdict per requirement: meets, does not meet, or partially meets, with evidence attached. The vendor should leave the final score alone. The buyer agent applies its principal's weights itself, because the cost of each miss belongs to the buyer, not to the vendor (Does this actually fit?).

4. Pricing as an API. "Contact sales" is a wall. The agent needs to send parameters (volume, seats, geography, usage pattern, support tier, term length) and get a deterministic, signed, time-limited quote back. The price has to expose the total cost of ownership, including onboarding, overages, egress, support, renewal caps, and the marginal cost of scaling. If pricing is hidden behind a human negotiation, the agent treats that as opacity and prices the risk in (Pricing as an API).

5. A sandbox and proof on its data. Every claim is a hypothesis until the agent can test it. The trial has to be programmatic enough to run representative data, compare the result to a ground truth, and measure output quality, latency, integration effort, false positives, and failure modes. A benchmark the agent runs beats any case study the vendor shows (Measure, don't believe).

6. Interoperability and no lock-in. The vendor has to plug into the rest of the buyer's agent stack: protocols for agent-to-agent exchange, tool access, audit logs, webhooks, export, and revocation. The agent also calculates the cost of leaving. Weak export, sticky contracts, or workflows that cannot move elsewhere all turn lock-in into a financial risk and lower the score.

7. Machine-readable contracting and settlement. Once the vendor passes evaluation, the transaction should not fall back to PDF archaeology. The agent needs structured terms it can compare, sign, monitor, and enforce: SLA, usage limits, data handling, renewal, penalties, credits, payment rails, and recourse when the service fails. After signature, those terms become the baseline for continuous measurement.

What the buyer agent pays attention to

A buyer agent weights a few signals far more heavily than the surface offer, and how a vendor performs on them never stays private. A failed benchmark, a quote that would not reproduce, or an export that turns out to be half-broken all end up in a record the next agent reads before saying hello. That record is the trust stack's sixth layer (Reputation as capital).

The key signals the agent monitors:

• Claim versus measurement. If the vendor promises 95 and the sandbox shows 70, confidence drops across every other unverified claim. Honesty compounds, but so does doubt.
• Determinism and reliability. The agent watches whether the vendor answers quickly, consistently, and repeatably. A seller agent that changes its story, hallucinates constraints, or cannot reproduce a quote is an operational risk.
• Data provenance. The agent cares where data comes from, how fresh it is, whether the sources are legal, and whether the evidence trail survives audit.
• Reversibility. Full export, portable logs, clear termination terms, and a measurable cost of leaving all matter. Lock-in is a financial risk to price into the decision.
• Security posture. To evaluate a vendor deeply, the agent may need to expose sensitive requirements, usage patterns, or data. That makes isolation, permissions, retention, and breach response part of the buying decision.
• Game dynamics. The seller agent optimizes for its principal, while the buyer agent protects its own. That pushes the interaction toward an adversarial setup: prompt-injection defenses, signed calculations, evidence over assertions, and private scoring logic.

Bets worth placing

None of this is settled. The stack above is a forecast of where the market is heading rather than an established standard. But some probes are cheap enough to run before the question resolves. Publishing a machine manifest and an llms.txt costs an afternoon: if agents never come, you lost the afternoon; if they do, you were readable first. Programmatic pricing and a self-serve sandbox are bigger wagers, but they pay off with human buyers too, which makes them worth trying even if agents stay rare for a while. Each of the seven expectations above is still a category with no clear incumbent. This series bets the bottleneck will be trust, and that the edge goes to whoever makes promises cheapest to verify.