Authority–Inference Separation in Agentic Finance: Intent-Bound Control, EVM Enforcement, and Replayable Assurance

Artificial intelligence (AI) agents can propose financial transactions, but model output should not itself grant execution authority. We develop Authority–Inference Separation (AIS), in which an independent control plane evaluates a typed financial action intent (FAI) against institutional mandate, policy, current state, human approvals, and exact economic terms before issuing single-use authority. We specify the threat and control boundaries, instantiate AIS across four financial domains, and test fixed fixtures, a separate external-policy-gateway baseline, mechanism ablations, two small open-weight models, and an Ethereum Virtual Machine (EVM) contract. In 36 fixed attack fixtures, AIS accepted no unauthorized effect, compared with 36 for direct execution and 20 for prompt policy. A gateway without execution-bound authorization accepted all 20 targeted post-decision attacks. Both models followed all eight injected counterparty substitutions; the independent gate prevented unsafe execution but authorized only six of 16 legitimate requests, exposing an availability cost. The EVM prototype rejected replay, revocation, stale-policy, and call-mutation attempts. These are conformance tests, not field estimates. AIS combines established security mechanisms around financial authority and replayable evidence. A ledger can enforce granted authority and record settlement, while mandate legitimacy, delivery, and accounting require complementary governance and evidence.