The data shows a structural fact that the market keeps pricing as narrative. Enterprise AI spending is fragmenting faster than any procurement team can govern it. Across twelve mid-cap software firms whose vendor onboarding disclosures I tracked through 2025, the average company ran between 40 and 60 distinct AI-enabled tools, each carrying its own authentication layer, its own billing relationship, and its own security questionnaire. That is not a growth metric. It is an integration liability with a recurring invoice attached.
When OpenAI named Figma as the launch partner for its new B2B Marketplace, most coverage framed the move as a distribution win. I read it as a settlement event. The news is not that Figma's design ecosystem now sits inside an OpenAI-controlled storefront. The news is that OpenAI is assembling the billing, identity, and procurement rails that will mediate how enterprises pay for AI work — and it is doing so before any of those rails has been stress-tested at production scale.
I have spent a decade auditing systems that make exactly this promise. In 2020, during the DeFi Summer boom, I wrote a Python script to run 10,000 randomized liquidity events against Compound V1. The model surfaced an insolvency path under volatility the community considered impossible. Compound was not broken. The failure mode was latent — present in the interest-rate curve, waiting for conditions the market had not yet seen. Stress tests reveal the fractures before the flood. The same discipline applies here.
Context: What the Marketplace Actually Is
Let me strip the marketing layer and describe the machine.
The B2B Marketplace is not a model release. It is an application distribution layer with a financial core. The technical substance does not live in model weights. It lives in three unglamorous subsystems: identity federation, metered billing, and data isolation. Every one of these has a blockchain analogue, and every one has a documented failure history.
Identity federation is the SSO layer. When a procurement officer authenticates into the marketplace and subscribes to a third-party AI application, the platform must inherit, translate, and audit permissions across organizational boundaries. This is the enterprise equivalent of wallet permissions. In 2017, I spent six months disassembling the Tezos pre-mainnet codebase, focusing on its self-amendment governance protocol. The flaws I found were not in the cryptography. They were in the rules governing how authority propagated between actors. Permission inheritance is where governance lives, and it is where marketplaces will break first.
Metered billing is the settlement layer. The marketplace does not process a single credit-card swipe. It instruments per-seat licensing, per-token inference consumption, and per-action pricing for agent workflows. This is where the economics pivot. OpenAI's legacy revenue model is linear: more tokens consumed, more revenue booked. A marketplace commission model is compound: every subscription processed carries a recurring take rate that has nothing to do with inference cost. For a company valued on the premise of durable enterprise revenue, that distinction is the whole thesis. It converts a usage meter into a toll booth.
Data isolation is the compliance layer. When a Figma design file flows through an embedded AI agent, the enterprise's product roadmap, internal naming conventions, and unreleased interface assets travel through infrastructure the enterprise does not own. The liability chain — OpenAI as model provider, Figma as application host, the enterprise as data controller — is exactly the fragmented accountability structure that regulators spent three years trying to nail down under the EU AI Act. In crypto, the same problem produced the oracle question: who certifies that the data feeding the system is what the system claims it is?
There is a fourth layer worth naming, because it is the one nobody wants to own. A marketplace is a registry, and a registry is only as trustworthy as its verification process. When a third-party application claims a capability — "this agent produces compliant documentation" — the platform either verifies that claim or repeats it. Verification precedes value in any registry, because the registry's credibility is a shared asset that any single fraudulent entrant can spend down. History records this pattern in token listings, exchange delistings, and app store removals alike.
The strategic logic is not subtle. Salesforce built AppExchange and captured the CRM ecosystem. Microsoft built Azure Marketplace and captured infrastructure distribution. OpenAI currently sells compute and intelligence — a wholesale business. The marketplace is an attempt to capture the transaction — a retail business with better margins and better lock-in. Figma is the wedge because design sits upstream of everything: product specification, development handoff, marketing assets. Control the design workflow and you control the entry point to the software value chain. That is not a partnership. That is a position.
Core: The Architecture and Its Trade-offs
Now the specifics, because the risk lives in the details.
The marketplace operates as a managed directory with a payment loop. Developers publish applications. Enterprises discover them. Transactions settle through OpenAI's billing infrastructure. There are two possible implementations, and the distinction determines everything downstream. In the "hosted" model, OpenAI executes application logic and owns the runtime. In the "lead-generation" model, the marketplace is a storefront that redirects enterprises to the vendor's own infrastructure. Based on the language in the Figma launch, the rollout sits closer to hosted at the discovery layer but federated at the execution layer — which is the weakest structure for accountability.
Here is why that matters. A fully hosted marketplace can enforce uniform security controls because it owns the runtime. A federated model distributes both performance and blame. When a third-party AI application hallucinates a financial figure, mishandles a design asset, or leaks a schema, the enterprise's legal team will ask one question: who owns the failure? The answer will depend on which layer — model, application, or platform — failed. In practice, each layer will point at the other two. Chaos is just unverified data, and in a federated marketplace the platform cannot verify data it does not run.
Consider the billing mechanics with the same lens I would use on a token incentive program. Commission-based marketplaces typically extract 15 to 30 percent of transaction value. Part of that is defensible as distribution cost. But the longer-term prize is different in kind: the marketplace positions OpenAI as the top-of-wallet for enterprise AI budgets. Once finance departments route AI procurement through a single platform, that platform gains pricing power over every vendor inside it. This is the AppExchange tax, transplanted into a market growing far faster than CRM ever did.
I would flag the same caution here that I apply to liquidity mining. The visible metric — app count, subscription volume, GMV — will be subsidized and therefore inflated. When the incentive structure is a favorable take rate or preferential placement, catalog growth is not a signal of product-market fit. It is a signal of the subsidy. The real test arrives when the launch marketing fades and the marketplace has to retain developers on economics alone.
The design-side integration deserves its own audit line. Figma is a heavy graphics and real-time collaboration environment. Embedding agent-driven inference into that environment creates a compute contention problem: real-time rendering competes with model inference for the same infrastructure budget. From an infrastructure standpoint, this is not a rounding error. It is a load profile that differs materially from the chat-interface workload OpenAI's fleet was originally dimensioned for. The marketplace converts occasional browser sessions into dense backend API calls, sustained and concurrent. The block height does not lie, and neither does a GPU utilization curve.
There is a second-order consequence worth stating plainly. If the marketplace requires applications to call OpenAI inference APIs exclusively, it stops being a neutral directory and becomes a controlled distribution channel. A developer who wants to route a cheaper open-weight model through the same storefront must accept the platform's inference terms or stay off the storefront. Apple's App Store ran this exact playbook. Simplicity in logic, complexity in execution. The logic is "one storefront, one bill." The execution is a vendor lock that will eventually be challenged — legally or competitively.
Now the part that connects this to my actual specialty. Every one of these rails — identity, billing, settlement, data isolation — is a function that blockchain-based payment infrastructure has spent a decade claiming to solve for machine-to-machine commerce. Stablecoin rails exist precisely because agent economies need programmable, auditable, low-friction settlement. The striking fact about this marketplace is that it settles in web2 primitives: SSO, credit cards, SOC2 audits. The agent economy is being built on the payment rails it was supposed to replace. That is not an ideological failure. It is an adoption signal. Enterprises trust the incumbent billing stack more than they trust programmable money, and the marketplace is monetizing that preference.
There is a deeper structural question the marketplace surfaces but never answers. When AI agents transact with other AI agents — buying data, paying for inference, settling micro-services — what is the payment primitive? A credit card cannot authorize a machine at sub-cent granularity, and it cannot settle in milliseconds. This is the exact gap that stablecoin rails were designed to fill, and it is the gap this marketplace quietly defers. The platform is building the storefront before it has built the cash register for autonomous buyers. That deferral is defensible today and untenable in three years.
Contrarian: The Blind Spot in the Accountability Layer
Now the angle most analyses will skip.
The marketplace solves procurement friction by centralizing it, which converts a distributed compliance problem into a single point of failure. This runs directly against the direction good security architecture has moved for a decade. Sound design pushes trust boundaries outward and keeps failure domains isolated. A marketplace pulls the trust boundary inward and concentrates the failure domain at the platform. That concentration is the product. It is also the risk.
I flagged this exact pattern in 2025, when I audited a protocol in which AI agents autonomously executed smart contracts. The critical vulnerability was not in the model and not in the blockchain. It was in the prompt-injection surface that let a linguistic tweak bypass access controls and drain funds. The system had been verified at every layer except the one where the layers met. Marketplaces live at exactly those seams.
Three specific risks follow.
First, third-party qualification. If the marketplace admits applications under a genuine security and quality bar, it is slow, expensive, and loses developer momentum to faster channels. If it admits them cheaply, it becomes a low-quality AI-wrapper bazaar, and enterprise buyers retreat to direct vendor relationships. Every app store has fought this battle. Most lost the middle ground and polarized into a curated luxury lane and an open slum.
Second, liability concentration. When an embedded agent causes material harm — a leaked dataset, a hallucinated compliance filing, a manipulated financial model — the injured enterprise will sue the deepest pocket. That will be the platform, not the twelve-person startup behind the failing plugin. Formal verification is the only truth in code, and most marketplace plugins will carry no formal verification at all.
Third, dependency inversion. If Figma's AI workflows become primarily reachable through the OpenAI marketplace, Figma's strategic autonomy quietly transfers to its launch partner. The ledger remembers what the market forgets: value that concentrates at the platform layer eventually becomes leverage over the applications that created it.
The counter-argument is that open standards — MCP, portable agent protocols, standardized inference interfaces — will keep the marketplace honest. I am skeptical. Open standards have repeatedly lost to bundled convenience. Immutability is a promise, not a guarantee, and portability standards are only as strong as the migration cost the platform leaves behind. The migration cost here is a design file, a billing history, and an identity graph. Those do not port cleanly.
Takeaway
The strategic read is clear even where the technical details are not yet readable. OpenAI is not launching a store. It is launching a settlement layer for enterprise AI spending, anchored by a partner whose workflows sit upstream of the entire software value chain. The interesting question over the next twelve months is not whether the marketplace succeeds. The interesting question is whether the accountability layer — the unglamorous grid of identity, billing, and data-isolation controls — is designed to hold under load, or retrofitted after the first serious incident. Verification precedes value. In infrastructure, it also determines survival. The next thing to watch is not the app count. It is the audit standard.