Authorization envelope
Agent Pay status: Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: /docs/agents/status.json.
When a human approves a payment draft, POINTS signs an authorization envelope. It records exactly what was approved, so the approval cannot be stretched to cover a different amount, payee, or time.
What it binds
The envelope is canonical JSON signed with HMAC-SHA256 on the server. Its fields:
| Field | Meaning |
|---|---|
v | Envelope version |
draftId | The approved draft |
amountCents, asset | Amount and currency approved |
payTo | The payee bound at approval |
fundingSource, settlementRail | Funding and rail, when set |
idempotencyKey | The key from prepare_payment |
approvedAt | When the human approved |
executableUntil | After this instant the authorization is refused |
executionOwner | The only component allowed to use it |
ownerUserId, approvedByUserId, agentId | Who owns the account, who approved, and which agent asked |
How it is used
- It is checked again before any use. The signature, the draft's current fields, expiry, and revocation are verified. If the amount or payee on the draft no longer matches the envelope, it is refused.
- Agents read the outcome, not the envelope. The signing key never leaves the server, so agents see the result through
get_payment_status:statusandexecuted: false. - It is not a payment. Approve does not execute. The envelope authorizes a use that is not enabled today; check /docs/agents/status.json.
- A missing signing key fails closed. Approval returns an error rather than an unsigned approval.
Related
- Lifecycle:
executableUntil, read-time expiry, and revocation. - Scoped approval: the spend envelope and approval ledger recorded alongside it.