Vanar, an infrastructure company focused on autonomous AI agents, has launched xBPP, an open-source protocol aimed at helping businesses decide what autonomous AI agents are allowed to do before they carry out payments, call APIs, or trigger transactions.
The new protocol is designed to sit ahead of execution, checking a proposed action against policy rules before it reaches payment rails or service infrastructure, the company said in a press release received by TimesCrypto.
Released under the Apache 2.0 license, xBPP is being offered as an open standard that developers, platforms, and companies can use without permission from Vanar.
A Decision Layer Before Money Moves
Vanar said xBPP is designed to fill a gap in agent-driven commerce, where the technology to authorize and execute transactions is advancing quickly, but the policy layer that decides whether an autonomous action should proceed remains less developed.
The company said the protocol is meant to answer practical questions before an action goes ahead, including whether it falls within budget, whether the counterparty is trusted, whether the request duplicates an earlier transaction, or whether human approval is required.
“Many of the building blocks for agentic commerce are now in place, but policy enforcement has remained an open problem,” said Jawad Ashraf, chief executive of Vanar.
He added that before businesses allow autonomous systems to control payments or service access, they need “a reliable way to define boundaries and apply them consistently.”
Built Around Rules, Not Instinct
Vanar said xBPP evaluates each proposed action against externally defined governance policies rather than rules embedded inside the AI agent itself, allowing organizations to update guardrails without redeploying their systems.
The first release includes a 1,760-line specification, a nine-phase evaluation pipeline, and 67 standardized reason codes. Vanar said the protocol returns one of three outcomes, Allow, Block, or Escalate, giving developers a structured way to govern agent behavior and preserve an audit trail.
The company noted that each decision can also be cryptographically signed and recorded, creating what it described as a verifiable record of why an action was permitted, blocked, or sent for further review.
xBPP “gives developers and enterprises a framework for enforcing decisions before execution, documenting outcomes, and expanding autonomy with the right safeguards in place,” Ashraf said.
Fitting Into the Agent Commerce Stack
Vanar framed xBPP as a complement to other tools emerging in agent-driven commerce rather than a replacement for them. The company pointed to systems such as Google’s AP2, the Linux Foundation-governed x402 standard, Stripe and OpenAI’s Agentic Commerce Protocol, and Mastercard’s Verifiable Intent as technologies that help agents authorize or execute transactions.
What those systems do not do, Vanar argued, is determine whether a transaction should happen in the first place.
The company said xBPP is payment rail agnostic and can work across traditional banking networks, stablecoin systems, and newer agent-native payment setups, with a reference TypeScript SDK released alongside the full public specification and related developer tools.
The launch signals a broader shift in the AI economy, where the focus is no longer just on helping agents act autonomously, but on deciding what boundaries should govern that autonomy.
