The payment rail authorizes the payment. Nothing authorizes the task.
The payment rail authorizes the payment. Nothing authorizes the task. An agent inside a valid session, with a valid token, can execute a task the human never approved. Payment authorization and task authorization are different objects, and today only one of them produces evidence. Yuthent binds the human's mandate into a hardware-bound, per-action signature so a dispute over an agent-initiated action terminates at verifiable evidence.
A concrete example
A customer instructs an agent to keep the pantry stocked, up to a monthly ceiling, from an approved list of merchants. The agent holds a delegated token. One week it executes a larger purchase at a merchant the human never named. The card network sees a valid credential and a valid cryptogram. The charge is authorized.
The customer disputes it. The investigation opens. What exists as evidence? Platform logs, produced by the platform whose conduct is in question, and a token trail that proves delegation existed. It proves nothing about what the human actually mandated. That investigation is the right to argue without evidence.
Why session and token evidence cannot answer it
Payment authorization and task authorization are different objects. The first proves a credential holder consented to a charge. The second proves the human approved the task the agent performed: what to buy, from whom, up to how much, until when. Today only the first produces an artifact.
A delegated token cannot fill the gap. It proves that delegation existed at some point, with some scope. It does not record the mandate's content, and it is presented by the same software whose behavior is disputed. A log produced by the platform is the platform's own account of what happened.
The mechanism: mandate binding at E and A tier
The human signs the mandate on their enrolled device: amount ceiling, counterparty scope, expiry, sealed into an Authoritative-tier payload with a hardware-bound key. Yuthent produces and verifies the signature and the payload hash. Your verify step checks each agent action against the signed mandate before execution. An action outside it is refused at your gate, and the refusal lands in the ledger.
PSD2 SCA dynamic linking already requires amount and payee bound into the authorization signature for human payments. Mandate binding extends the same discipline to the agent's task. What an investigator holds afterwards is an ES256 artifact, independently verifiable against a published key, bound to the parameters the human actually approved.
Common questions
If the payment was authorized, what is missing?
The task. Payment authorization proves a credential holder consented to a charge. It proves nothing about the task the agent performed to get there. The human may have mandated a bounded purchase from an approved counterparty. The agent may have executed a different purchase at a different merchant. The rail authorized both charges equally.
The human approves at T0 and the agent executes at T1. What connects them?
The signed mandate. At T0 the human signs the mandate parameters on their enrolled device: amount ceiling, counterparty scope, expiry. The signature is hardware-bound and covers those parameters, made in a sealed Authoritative-tier ceremony. At T1 your backend verifies every action against the T0 mandate. An action outside the signed parameters does not proceed on that mandate: it stops and returns to the human for a fresh approval, and an expired or revoked mandate fails outright. Either way the attempt lands in the ledger.
Does the proof decide the dispute?
No. It is evidence. The artifact exists, it is independently verifiable as ES256 against a published key, and it is bound to the mandate parameters. Your dispute process, your regulator, or your court weighs it. Yuthent produces the object the investigation was missing.