Below the mandate: Agent-initiated transactions on card and ISO 20022 rails—A systematization of authorization, liability, and dispute risk

AI agents are starting to make payments on people’s behalf. Card networks and protocol groups now offer ways to give an agenta scoped card credential and to attach a signed record of what the user asked for. These mechanisms are good at showing thata user really did hand authority to a particular agent. They say much less about whether a specific payment matched what theuser wanted, and we refer to the gap between these two questions as the region below the mandate. In this paper we systematizeagent-initiated payments on two families of rails: card authorization, based on ISO 8583 with tokenization, 3-D Secure and storedcredential extensions, and ISO 20022 credit transfers, including instant schemes such as FedNow and RTP. For each rail we lookat what can be checked at authorization time, who bears the loss under current U.S., EU and UK rules, and what dispute route isopen to the user afterwards. We define seven classes of mandate divergence and follow each one through both rails. Across theanalysis, delegation tends to turn agent errors into payments that are authorized in the legal sense, which takes them outside thestrongest consumer protections. Card rails allow some of the loss to be recovered through disputes, but push rails mostly do not,and a payment redirected by an injected instruction is not clearly covered by any reimbursement scheme we examined. We endwith eight recommendations and a set of open problems.