Someone Has to Sign for It

In #015 I ended with a specific image. An account principal configures an agent, sets the ceiling, defines the scope, and then leaves the room. The agent acts on their behalf, across a household, across every surface the family touches, on behalf of people the principal is responsible for.

The principal is not watching. They set the governance once, imperfectly, and trusted the constraint would hold.

I promised you the close: when that delegation happens and the agent acts, when the ceiling fails, when the agent books the wrong flight or touches a financial account it wasn't supposed to touch, what is the legal and commercial structure of what just happened? Who is liable? What does the contract actually say?

Here is what I found. The payment layer has been built. The authorization layer has not. And those are not the same thing.

The News: Visa Solved the Transaction. Nobody Solved the Mandate.

In early June, Visa published its framework for what they're calling intelligent commerce, a scheme for issuing tokenized payment credentials specifically to AI agents. The model is elegant. Instead of handing an AI agent a real credit card number, you issue it a limited-access token: scoped to a merchant category, capped at a spending amount, valid for a defined window. The agent has something that acts like a payment method but cannot be used outside the box you drew around it. Mastercard has an equivalent scheme. Stripe's agent payment infrastructure is moving in the same direction. Every major payment rail is either shipping or announcing the same basic pattern: tokenized, scoped credentials that let an agent pay without carrying the full account.

This is genuinely good infrastructure. The payment problem for agentic commerce is real and the token-scoping model is the right architecture for it.

But here is what that architecture does not answer, and what the Visa framework does not address anywhere in its documentation.

It does not answer who authorized the agent to act. It does not answer on whose behalf the agent was transacting. And it does not produce a receipt that settles the dispute when it goes wrong, a receipt that is legible to the household principal who wasn't in the room, attributable to the specific delegation that authorized the action, and cryptographically verifiable when the vendor, the payment rail, and the agent disagree about what happened.

Visa solved the payment. Nobody has solved the mandate.

The Assumption I Carried Into This Edition (And Where It's Wrong)

When I started tracking the agent governance problem in #012, I was focused on the spending ceiling. The claim was: agents can pay, nothing checks. The gap was a payment authorization layer.

That was incomplete in a specific way.

I was treating authorization as a payment problem. If you cap the token, you cap the spend. The ceiling holds and the governance is done.

Here is the correction. Payment authorization and action authorization are not the same problem.

An agent that books a flight with a scoped Visa token has proven two things: it had a valid payment method, and that method was within its spending limit. It has not proven, to the vendor, to the household principal, to any regulator who later asks, that the specific person on whose behalf it acted authorized that specific action, in that specific context, at that specific moment.

This distinction sounds academic until you're in a dispute.

The principal's elderly parent calls and says the trip was wrong, the dates were off, the airport was different than they needed. The airline's agent records show the booking was made by an AI assistant. The Visa token was valid. The spend was within scope. Every system that checked anything checked out clean.

What is missing is the one piece of evidence that tells you whether the agent was acting within the principal's mandate when it made the specific choice that went wrong. Not whether the payment was authorized. Whether the action was authorized. Whether someone can look at the decision log and say: yes, this was within scope, or no, this exceeded the mandate, and here is the exact constraint that was violated.

That is not a payment receipt. It is an action receipt. And it is the governance primitive that does not exist.

Why Attributable Proof Is The Missing Layer

Let me be precise about what attributable proof actually is, because it's easy to confuse it with existing things.

It is not a log. Logs tell you what happened. Attributable proof tells you whether what happened was authorized, by whom, against which mandate, and whether the constraint that was supposed to hold actually held.

It is not a permissions record. Permissions tell you what the agent was allowed to do in the abstract. Attributable proof is the signed record of a specific action against a specific delegation at a specific time.

It is not a smart contract. Smart contracts enforce rules automatically. Attributable proof is the receipt that exists whether or not enforcement happened, the artifact that lets you reconstruct the chain of authority after the fact, when something has already gone wrong.

Attributable proof has three components, and all three matter.

First: who authorized this. Not the payment token issuer. The human principal, the account holder, the household manager, the adult child who set the ceiling, whose mandate the agent was executing when it acted.

Second: on whose behalf. The specific dependent user the agent was serving at the moment of action. Not the principal. The person who had the conversation, asked for the thing, and trusted the answer.

Third: the cryptographic receipt. Not a plain-English summary (though that matters too). A signed artifact that can be verified independently, by the vendor, by the payment rail, by a regulator, by the principal reviewing what their agent did in their absence, without having to trust any single party's account of what happened.

This is the governance primitive the entire household-delegation model requires. You cannot have an account principal set a spending ceiling and then know whether the ceiling held, without a receipt that proves it held or proves it didn't. You cannot have a vendor accept an AI-initiated transaction and know whether the agent was acting within its mandate, without an artifact that carries the mandate's scope alongside the payment credentials. You cannot have a household of delegated agents transact on behalf of a buyer who isn't present, the structure #014 and #015 established, without a mechanism for settling disputes that doesn't require everyone to trust everyone else's log.

The Visa token solves the "was the payment method authorized" question. Attributable proof solves the "was the action authorized" question. Until both exist, the household principal is trusting that nothing went wrong, not knowing.

Why The Legal Gap Is Already Here

This is not a future problem.

Every platform that has shipped AI agents capable of cross-site action, and as of Apple's WWDC keynote, that includes the most popular consumer device on the planet, has shipped into a world where the agent's authority to act is entirely implicit.

Implicit means: the vendor trusts the platform, the platform trusts the agent, the agent trusts the user, and the user trusts whoever set it up. That chain of trust has no artifacts. When it breaks, there is nothing to reconstruct it from.

The legal frame for an AI-initiated transaction right now is the same as the legal frame for any automated transaction: if the payment cleared and the merchant performed, the transaction is complete. There is no provision in current payment law for "the agent exceeded its mandate" as a basis for dispute resolution. Chargeback rules are about fraud, not scope. The principal who set a ceiling and watched the agent exceed it has no existing remedy that distinguishes their situation from simple unauthorized use.

That gap will close, and when it does, the governance receipt will become mandatory infrastructure. The question is whether the receipt exists before or after the disputes start accumulating.

Every other regulated industry learned this lesson after the losses, not before. Every financial instrument that carries accountability now, CUSIP numbers, trade receipts, SWIFT confirmations, was built because something went wrong without one and the resolution was expensive enough that everyone agreed to the overhead.

Agentic commerce is accumulating the transactions right now. The accountability infrastructure is not there yet.

Where Accords Sits In This

I have said it in every edition since #012 and I will say it plainly one more time, because this is the edition where the argument closes. Accords governs what agents do on the open internet.

That sentence is not about routing. It is not about payment tokens. It is about the attribution layer, the infrastructure that carries the principal's mandate alongside every action the agent takes, and returns a signed receipt that proves whether the mandate held.

The Visa token answers "was payment authorized." AccordsVault answers "was the action authorized, by whom, against what scope, and here is the proof." Those are sequential layers and they are both required. Only one of them exists.

The household principal in #015 set a ceiling and left the room. The agent acted. What AccordsVault provides is the mechanism by which that principal can return, a minute later, a week later, after a dispute, and see exactly what happened, exactly whether the ceiling held, and exactly what proof exists to settle the question against any party who tells a different story.

That is not a feature. It is the floor of the governance model. You cannot have the commercial structure of #014 and #015, delegated agents, non-present principals, household-distributed trust, without it.

The Falsifiable Close

Here is what would break this frame.

If the major payment rails extend their token-scoping model to include a signed action-authorization layer, if Visa's tokenized credential carries not just spending scope but a principal identity and a mandate hash that travels with every transaction and creates a verifiable receipt, then the payment infrastructure closes the authorization gap without requiring a separate governance layer.

That would require every payment processor to agree on an attribution format, every AI agent to sign action requests against that format, and every vendor to accept and verify signed mandate receipts as part of the transaction flow. It is technically possible. It is commercially very hard.

Watch for: any payment rail announcing an AI-agent transaction format that includes principal attribution as a first-class field, not a metadata add-on. If Visa's next update to the intelligent-commerce spec includes a mandate hash in the token payload, that is the signal. I will report it when I see it.

As of June 30, 2026, the token spec carries spending limits and merchant-category scope. It does not carry the principal's identity, the dependent user's context, or the mandate that governed the specific action. The attribution layer is still open.

The arc closes here. The missing primitive was never the payment. It was always the receipt.

If you are forwarding this, send it to whoever in your life will be the first person to ask "wait, who authorized that?" when an agent does something they didn't expect.

Max