The Web Is Forking

The Web Is Forking. Why, and Who Wins. A week of “agent infrastructure” launches shows why One Degree is turning into law, not language. Last Tuesday, a developer opened a terminal and copied a command that creates a wallet for software. The act itself was ordinary. It looked like any other provisioning step, the sort of thing that happens quietly in modern stacks. The unusual part was what the wallet was for. Not a person, not a service account in a familiar sense, not a test harness. A wallet designed for an agent to hold value and spend it under constraints, with guardrails written into the interface of money. Hours later, a different engineer solved a different problem with the same indifference. When an agent asks for a web page, the agent does not want the page. It wants the page after the web has been stripped of the things humans tolerate and machines resent. So, the engineer toggled a feature that turns HTML into Markdown when the client asks politely, and a response header tells the client how many tokens the page will cost. Not long after that, another team published a way for agents to open a hosted container, install dependencies, run scripts, and write files to disk. That last part is the tell. Writing files is where the line between “assistant” and “worker” stops being philosophical.

None of these acts required a meeting between the companies involved. None of them required a shared press strategy. That is what makes the pattern worth taking seriously. Convergence is what markets do when they see the same downstream constraint coming, and decide to build the same kind of gate. The problem is not that agents are arriving. The problem is that authority is. The video that pulled these threads into one story is here. https://www.youtube.com/watch?v=QcmhR4vsgWA

It is tempting to treat it as a tour of product releases. Coinbase builds wallets for agents. Stripe builds commerce rails for agents. Cloudflare builds a web variant for agents. OpenAI builds execution primitives for agents. A reader can nod along and file it under, “AI is speeding up.” That is not what is happening. This is a reordering of distance. It is a reordering of how many human hands must touch a decision before it becomes an action. It is a reordering of where risk lives, where fees live, and where the record will be written when something breaks. “What would have to be true for this outcome to keep repeating.” The prevailing belief is that the next era belongs to whoever builds the best agents. It is a reasonable belief. Better agents seem like they should produce better outcomes. They can read more, summarize faster, and do work that used to take people days. They can stitch APIs together, send emails, draft code, and run analysis at a speed that makes last decade’s software look slow. If you stop there, you miss the mechanism and you miss the bill. Capability does not create value in the enterprise. Authority does. Authority is the right to act. Authority is a boundary. It is permission, expressed in a way that can survive audit, survive dispute, and survive a bad day when the system runs into an adversary. The video calls the web “forking.” That is a useful image, as long as we keep it grounded. One fork remains human. Fonts, layouts, persuasion, checkout flows, trust badges, tracking pixels. The other fork is software. Structured data, machine-readable content, machine-to-machine payment negotiation, execution environments, and a constant assumption that the caller is not an employee, not a customer, and not trustworthy by default. A fork like that does not stay on YouTube. It becomes a budget line. It becomes a covenant. It becomes a legal posture. It becomes a new definition of what it means for a system to be in control.

Agents do not create value. Authority does.

The buyer who never moves a mouse Stripe’s contribution to this story is not the idea of agentic commerce. Software has been buying software for decades, and bots have been clicking “buy now” for nearly as long as retailers have had a “buy now.” Stripe’s contribution is that they are treating the next wave of buying as a distinct client type, and they are building primitives that admit the old signals no longer work. The video describes the failure in a single sentence that should make any board pay attention. Agent traffic does not move a mouse. It does not browse. It does not exhibit human variability. Fraud models tuned to human behavior start mislabeling legitimate delegated transactions as fraud, and they start missing new fraud patterns that exist only because the buyer is software. This is One Degree in a payments costume. When the actor changes, the evidence changes. When the evidence changes, the trust mechanism changes. When the trust mechanism changes, the entire operating model of commerce changes. Stripe’s Shared Payment Tokens are not marketing garnish. They are a way to pass permission without passing credentials, and to scope that permission by seller, by time, and by amount. They turn “I authorize you to buy” into something the system can enforce, log, and later dispute if necessary. They are a token not in the abstract crypto sense, but in the concrete security sense. A bounded credential that can expire, can be limited, and can carry risk signals along with it. That detail matters because it reveals what serious builders are doing in practice. They are not building “autonomy.” They are building delegated authority with an audit trail. This is why the loudest conversations about agents are also the least useful. They focus on what the agent can do. The enterprise cares about what the agent is allowed to do, and about what happens when the agent is wrong. A procurement system that can place orders without a human is not valuable by default. It becomes valuable when it can place only the orders it is permitted to place, for the reasons it is permitted to use, against evidence that is admissible inside your governance model. A system that cannot meet that bar is not a procurement system. It is a fraud accelerator that can type. The video points to wallet primitives, to token primitives, to payment protocols that revive HTTP’s long-unused “payment required” semantics. The point is not which protocol wins. The point is that a single transaction now requires a machine-readable negotiation of authority, and the firms that own that negotiation become the gate. Gates collect tolls. Gates also collect blame.

Markdown is not a format choice. It is a permission choice

Cloudflare’s Markdown for Agents is easy to misunderstand because it sounds like a technical convenience. It is not. It is a statement about who the client is, and what kind of relationship the web will have with that client. HTML is full of human ceremony. It carries layout, navigation, scripts, ads, tracking, and the kinds of persuasive scaffolding that make a page legible to a person and profitable to a publisher. An agent has no interest in most of that, and it pays a direct cost to ingest it anyway. Tokens. Latency. Confusion. Attack surface. Markdown is an admission that the web is turning into an evidence supply chain for machines. It is also a way to convert a blunt instrument, scraping, into a negotiation. If a site owner opts in, the site can deliver a machine-readable variant without playing cat-and-mouse with crawlers. It can declare what is allowed. It can declare what is not. It can, in time, declare what is paid. Cloudflare’s broader “AI Index” work makes this explicit. Instead of indiscriminate crawling, the model they outline is subscription to specific sites, structured updates when content changes, and compensation per access. That is not a feature. That is a new contract between the producer of evidence and the consumer of evidence. The web has lived for two decades on the assumption that content will be crawled, recombined, and monetized somewhere else. The human web tolerated that because the user experience was still, in the end, human. People saw ads. People clicked. People typed in card numbers. The agent web does not behave like that. Software requests content, extracts facts, acts elsewhere, and never sees the human-facing business model. So the web is being rebuilt for a client that does not participate in the old trust rituals, and does not pay unless payment is part of the protocol. When the client is software, the interface becomes permission. If you want to see One Degree in the wild, watch where engineers move from “serve the content” to “serve the content under declared constraints.” That is permission architecture becoming the web’s new front door. This matters for CEOs and boards for a reason that is easy to miss. In a world where agents consume content at machine speed, the firm that controls permission controls the economics. If your product is discoverability, but your discoverability depends on human search, you are on the wrong fork. If your moat is “we have the user’s attention,” but the user delegates their attention to a tool that never visits your site, your moat was never a moat. It was a toll booth on a road that is being bypassed. There is a second-order cost that arrives next, and it will not show up as an “AI expense.” It shows up as litigation. If a publisher serves one version to humans and a different version to machines, you have an incentive to manipulate the machine view. That incentive exists even if

you never act on it. It exists because conversion becomes cheap. Cheap conversion creates cheap deception. Cheap deception creates a trust collapse. When trust collapses, regulators arrive. One Degree does not promise comfort. It promises a clearer map of where the bill will land.

Latency becomes money, and money becomes time

There is a line in the prompt that every CFO understands instinctively. Time is not free. Yet organizations treat it like it is, especially when the time is spent in “alignment,” “governance,” and “risk control” rituals that feel responsible. The agent web is about time in a more literal sense. It is about how many steps sit between an intent and an outcome. If an agent must search, parse, verify, call a tool, call another tool, and then decide whether to act, every millisecond of latency compounds across a chain. In a human workflow, latency is often hidden inside the calendar. People wait for approvals. People wait for meetings. People wait for someone to answer an email. The clock is visible, but it is treated as normal. In an agent workflow, latency is a unit cost. It is CPU time. It is token time. It is network time. It is an invoice. That is why the emergence of agent-native search providers matters, even if you do not care which company wins the category. The winner will not be the one with the prettiest interface. The winner will be the one whose retrieval pipeline can provide admissible evidence quickly, with enough provenance to survive downstream evaluation. This is where the story gets sharper for One Degree. Evidence is not a blob. Evidence is a constraint. What data is allowed, from where, under what permission, with what freshness, with what checks, and with what record. If you do not specify evidence, an agent will still produce an answer. That is the trap. The answer will feel helpful and be operationally dangerous. Latency is not an engineering detail. It is a compound interest rate. You can see why infrastructure firms are converging. Payments without identity and permission are a fraud engine. Content without machine-readable constraints is a scraping war. Search without low latency and high precision is a cost sink. Execution without containment is a breach waiting to happen. The web is not becoming “smarter.” It is becoming executable.

The container is the new cubicle

OpenAI’s shell tool is described as “execution for agents.” That framing is correct, but incomplete. What matters is that the execution happens inside a controlled container, with network policy and tool access that can be bounded by organization and by request. This is where the agent conversation stops being about prose and starts being about operations. When an agent can install dependencies, run scripts, and write files, you have created a worker. A worker that never sleeps, and a worker that can also be tricked into doing something expensive, dangerous, or simply wrong. OpenAI’s “skills” are versioned bundles of instructions and supporting files, mounted into environments so an agent can run a procedure consistently. That sounds like software engineering. In the best cases, it will become software engineering. The counterexample sits in the comment thread beneath the video, and it deserves to be treated as ballast, not as footnote. A veteran systems engineer describes building an AI-driven financial analysis pipeline with multiple models, convergence evaluators, validation gates, and automated data acquisition. Then he describes the failure mode that any operator should respect. The “compiler” is undefined. A model can read rules, acknowledge rules, and still ignore rules in calculation. Small instruction edits can cause large output swings. Model updates can change behavior without a changelog. Temperature introduces nondeterminism where software engineers expect repeatability. He is not saying the architecture is wrong. He is saying the execution engine is probabilistic, and that changes what it means to deploy procedures as “packages.” This is the moment where One Degree stops being a slogan and becomes a requirement. If the execution engine is probabilistic, authority must be bounded, and verification must be deterministic. A skill bundle can improve consistency, but it cannot guarantee compliance. Not by itself. To reach enterprise-grade reliability, you need gates that fail closed. You need evaluation harnesses. You need typed outputs. You need monitoring that detects drift. You need rollback, and you need the habit of treating agent behavior as something to be audited, not admired. A versioned procedure is not a compiler. When people say they want “agentic workflows,” what they often mean is that they want to remove human coordination cost. They want to cut the meeting load. They want to reduce the time between signal and action. They want to replace the human middleware layer with software. That desire is rational. It is also how you end up building a faster way to fail, if you treat agency as capability rather than as bounded outcome-shaping under explicit authority.

This is why the video’s most important line is the one about security, not the one about speed. Serious security approaches treat every agent as a potential adversary. Not because they are paranoid, but because the surface area is real. An agent that can search can be redirected to adversarial content. An agent that can execute can run hostile code. An agent that can pay can be drained. That is not an argument against agents. It is an argument against sloppy authority.

The loop closes when agents can pay for their own compute

The video uses prediction markets as an example of how the economic loop can close. Agents earn money. Agents pay for compute. Agents run again. The loop is self-funding. There is a seductive futurism in that picture, and there is a more ordinary truth underneath it. Markets are another place where latency, evidence, and authority compound quickly. If you can act faster than the next participant, you can extract value. If you can act faster with better evidence, you can extract more value. If you can automate that action without needing permission at every step, you can extract value continuously. This is why institutions are taking prediction markets more seriously. When Dow Jones signs a deal to bring prediction market data into outlets like The Wall Street Journal and Barron’s, it is not a cultural curiosity. It is a signal that these markets are being treated as a new form of realtime belief data that readers and investors will accept as relevant. When Reuters writes about software firms facing higher borrowing costs and tighter lender scrutiny under AI disruption risk, it is the same story told in a different register. The market is repricing distance. The agent web accelerates that repricing because it converts latency into economics. Humans can be slowed down by process and still survive for a while. Software that is slowed down simply becomes uncompetitive. If the loop closes, the question becomes who owns the permission surface that controls the loop. A wallet with guardrails is one version. A payment token scoped to seller and time is another. A content access protocol that requires payment is another. An execution environment bounded by allowlists is another. One Degree is what happens when you connect them. It is the idea that access is the architecture of permission, and permission is the architecture of risk.

The false comfort of “trust will catch up

” The video ends with a line that sounds reasonable, and is often wrong in practice. The idea that trust will catch up to capability. Trust does not catch up. Trust is built into the gate. When trust is not built into the gate, the enterprise compensates with meetings, approvals, and politics. That is how organizations protect careers when they cannot protect outcomes.

This is not a moral problem. It is an architectural problem. If a firm cannot audit why an agent acted, it will not grant authority to act. If it cannot bound what an agent can touch, it will not grant authority to touch anything that matters. If it cannot reverse what an agent did, it will keep humans in the loop, not because humans are better, but because humans are blame-compatible. That is why the “agent web” framing is incomplete. The web is not only forking into human and machine. The web is forking into permissioned and unpermissioned. Unpermissioned systems will grow fast. They will also produce the incidents that slow trust, invite enforcement, and create a moral hazard where the builders profit and the users pay. Permissioned systems will move slower at first. They will win the domains where downside matters. This is the governance story that most executives do not want to hear, because it forces a choice. Speed or safety. Autonomy or control. Value or liability. The truth is more painful. Without permission architecture, you do not get speed or safety. You get noise, and then you get a new bureaucracy invented in a hurry.

Two boardroom paragraphs that tell you if you are ready

When your teams tell you they are “building agent workflows,” can they answer this without handwaving. Where exactly is authority expressed in the system, and where exactly is it enforced. Is it in tokens that expire. Is it in allowlists that constrain network calls. Is it in roles that map to decision rights. Is it in a policy engine that can fail closed. If an agent places an order, refunds a customer, changes a configuration, or writes to a system of record, can you show the record that says what evidence it used, what constraint it applied, and what would have stopped it. If you cannot show that record, why do you think you will be able to defend the outcome. When your teams tell you they have “guardrails,” can they answer this without changing the subject. What is the fastest way the system can be tricked into violating intent while still obeying syntax. What is the simplest prompt injection that can make it fetch evidence from a poisoned source. What is the smallest configuration edit that changes behavior across the fleet. What happens after a model update that alters interpretation of an instruction bundle. If the answer is that you will find out when it happens, you are not building guardrails. You are building a story about guardrails. These are not academic questions. They are the questions that decide whether your organization is gaining control, or merely installing a faster way to lose it.

A prediction that will be embarrassing if wrong

By December 31, 2026, at least one major card network will publish a formal standard for delegated agent payments that mirrors the logic already visible in scoped payment tokens, and at least one major web infrastructure provider will make pay-per-crawl style access negotiation a default commercial product rather than an experiment. If that does not happen, it will mean either the agent web slowed more than its builders expected, or the incumbents failed to admit what their own primitives already suggest. Either way, the result will be visible, and it will matter.

The part that does not get said out loud

The market does not punish firms because a new tool exists. It punishes firms because a new tool collapses a degree of separation that used to justify a margin. A $285 billion rout in public equities does not occur because the internet discovered “AI.” It occurs because investors suddenly believe that a category of intermediated work has become compressible. The same dynamic will hit inside the enterprise. Not as a headline, but as a reallocation of authority. The firms that treat agency as “what the model can do” will spend a lot of money and still live in meeting hell. The firms that treat agency as “what the system is allowed to cause” will rewrite how work is allocated, how risk is priced, and how decisions move. That is why One Degree is not optional language. It is the simplest way to describe what is becoming true. Distance is collapsing. Permission is becoming the interface. Authority is becoming the unit of value. The web is forking. The bill lands on governance. Authority is the web. References This narrative draws on Nate B Jones’s February 21, 2026 video on the emerging “agent web” and its claim that infrastructure primitives are converging faster than enterprise trust, then verifies the underlying primitives through primary sources, including Coinbase’s February 11, 2026 Agentic Wallets launch describing TEEs, non-custodial design, x402 support, and programmable guardrails, Cloudflare’s February 12, 2026 Markdown for Agents release and supporting documentation on content negotiation and token-count signaling, and OpenAI’s February 11, 2026 developer post on Shell, Skills, and server-side compaction as execution and packaging primitives for long-running agents that write files and run code. It grounds the commerce layer in Stripe’s December 11, 2025 newsroom release and technical write-up on the Agentic Commerce Suite and Shared Payment Tokens as scoped, time-bounded payment delegation, and it anchors the protocol and monetization direction in Cloudflare’s September 23, 2025 x402 Foundation announcement with Coinbase and Cloudflare’s September 26, 2025 AI Index post outlining opt-in indexing, machine-readable site maps, subscription-style retrieval, and pay-per-crawl economics. It treats the market repricing as evidence of consequence, using

Bloomberg’s February 3, 2026 reporting of a $285 billion rout tied to AI automation fear, and Reuters reporting from February 23, 2026 on lender scrutiny and credit spread changes for software firms under AI disruption risk. It uses Reuters’ January 7, 2026 coverage of Dow Jones’s Polymarket data partnership as a marker that machine-mediated belief data is moving into mainstream financial media. It also uses Michael Carroll’s own One Degree doctrine and operating language on agency as outcome-shaping, on authority as the unit that compounds value, and on provenance discipline as foundational for any enterprise claim about agents.