Foresight News reported that Virtuals Protocol co-founder Chris Johnson introduced Ethereum standard ERC-8196, called the AI Agent Authenticated Wallet, in a post on X. According to Foresight News, the standard was co-released with Cybercentry founder Leigh Cronian and has now entered Final status, meaning its technical specification has completed community review and can only receive errata corrections, with no further substantive changes.
The standard defines a policy-bound transaction execution interface for AI agent wallets. The wallet will only execute a transaction when the action includes cryptographic proof that matches the asset owner's preset policy. ERC-8196 is the second layer of the agent trust system, focused on execution, and is designed to work with ERC-8126, which covers identity recognition and risk scoring.
Before each execution, the wallet must query the agent's latest risk score under ERC-8126 through the agentId. If the score exceeds the policy's minVerificationScore threshold, the wallet must reject the transaction. The policy fields include the authorized agent address, allowed action types, contract allowlists and blocklists, per-transaction limits, optional daily limits, and effective and expiration timestamps.
Authorization is bound through EIP-712 structured signatures in the form of a policyHash to prevent replay across policies. The standard also introduces a hash-chain audit log, where each record contains the previous hash so tampering can be detected, and an entropy commitment-reveal mechanism intended to reduce the risk of custodians manipulating probabilistic decision results. It also recommends an active suppression mechanism for faster responses to policy violations.
ERC-8196 is compatible with ERC-4337 account abstraction wallets and also supports traditional credential delegation through TLS authentication. The security guidance says that even if the overall risk score is acceptable, the wallet should still reject or revoke delegation if ERC-8126 wallet verification detects signals such as sanctioned funds, mixer usage, or links to known malicious addresses.