Below the mandate: Agent-initiated transactions on card and ISO 20022 rails—A systematization of authorization, liability, and dispute risk

Abstract

AI agents are starting to make payments on people’s behalf. Card networks and protocol groups now offer ways to give an agent
a scoped card credential and to attach a signed record of what the user asked for. These mechanisms are good at showing that
a user really did hand authority to a particular agent. They say much less about whether a specific payment matched what the
user wanted, and we refer to the gap between these two questions as the region below the mandate. In this paper we systematize
agent-initiated payments on two families of rails: card authorization, based on ISO 8583 with tokenization, 3-D Secure and storedcredential extensions, and ISO 20022 credit transfers, including instant schemes such as FedNow and RTP. For each rail we look
at what can be checked at authorization time, who bears the loss under current U.S., EU and UK rules, and what dispute route is
open to the user afterwards. We define seven classes of mandate divergence and follow each one through both rails. Across the
analysis, delegation tends to turn agent errors into payments that are authorized in the legal sense, which takes them outside the
strongest consumer protections. Card rails allow some of the loss to be recovered through disputes, but push rails mostly do not,
and a payment redirected by an injected instruction is not clearly covered by any reimbursement scheme we examined. We end
with eight recommendations and a set of open problems.