The receipt cannot be written by the pen it is checking: separation of duties for agent payments

Short summary

Agent payment systems must satisfy three properties: temporal-liveness binding where the mandate remains active at execution time, verifier independence where attestation is signed by a party that cannot forge it, and authorized mutation where changes stay within pre-authorized bounds. Revocation must be dominant—a revoked mandate blocks execution regardless. Without separation of duties, audit trails become testimony rather than cryptographic evidence.

• •Mandate must remain active at execution time, not just signing—revocation blocks regardless of intent freshness
• •Verifier must be independent from payment-writing party (like ASPSP in PSD2)—verifier cannot be the same entity writing the receipt
• •Authorized mutations only—changes to payments limited to pre-authorized fields and bounds per the mandate

Generated with AI, which can make mistakes.