Principal, agent, and mandate
The principal is the person or entity represented. The agent performs tasks within defined autonomy. A mandate connects these parties with purpose, allowed scopes, financial limits, validity, and autonomy level. An agent must not be able to expand its own authority.
Lifecycle and revocation
A delegation may move through created, pending-consent, active, suspended, revoked, and expired states. Reliable verification checks the current state, including policy changes and revocation after a credential was issued.
Transaction-level enforcement
Before recommending a transaction, evaluate merchant, amount, purpose, scope, and limits against the valid mandate and institutional rules. A session token alone does not establish that a customer approved a particular purchase.
Outcome and evidence
A decisioning layer may recommend APPROVE, DENY, CHALLENGE, or REVIEW with supporting reasons and provenance. The institution governing the funds retains final authorization and execution authority.
Are OAuth scopes or JWTs sufficient to authorize an agentic payment?
Not necessarily. Credentials and scopes help, but current mandates, transaction purpose, and institutional rules must also be evaluated.