The receipt cannot be written by the pen it is checking: separation of duties for agent payments

Agent payment standards are converging on a signature. Prove the agent was authorized, sign the mandate, attach it to the call. The wire is covered.

The wire being covered is not the same as the boundary being provable. That gap is where agent payments will actually fail.

Work through it with three properties a conformance test has to survive. These were argued out in the open this week with John Frandsen of open-banking.io, in the comments of a prior post, and they sharpened the preprint enough to name here.

First: authorization has a clock

A mandate captured at T0 does not bind an intent that forms at T0 plus delta if the authorization state changed in between. A revoked consent. An expired SCA. A lowered daily limit.