---
title: Authorization envelope
description: The signed object POINTS records when a human approves a payment draft, and what it binds.
url: https://thepoints.io/docs/agents/concepts/authorization-envelope
audience: [agents, operators, developers]
status: Live (authorization only)
---

# Authorization envelope

> **Agent Pay status:** Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: [/docs/agents/status.json](/docs/agents/status.json).

When a human approves a payment draft, POINTS signs an authorization envelope. It records exactly what was approved, so the approval cannot be stretched to cover a different amount, payee, or time.

## What it binds

The envelope is canonical JSON signed with HMAC-SHA256 on the server. Its fields:

| Field | Meaning |
|---|---|
| `v` | Envelope version |
| `draftId` | The approved draft |
| `amountCents`, `asset` | Amount and currency approved |
| `payTo` | The payee bound at approval |
| `fundingSource`, `settlementRail` | Funding and rail, when set |
| `idempotencyKey` | The key from `prepare_payment` |
| `approvedAt` | When the human approved |
| `executableUntil` | After this instant the authorization is refused |
| `executionOwner` | The only component allowed to use it |
| `ownerUserId`, `approvedByUserId`, `agentId` | Who owns the account, who approved, and which agent asked |

## How it is used

- **It is checked again before any use.** The signature, the draft's current fields, expiry, and revocation are verified. If the amount or payee on the draft no longer matches the envelope, it is refused.
- **Agents read the outcome, not the envelope.** The signing key never leaves the server, so agents see the result through `get_payment_status`: `status` and `executed: false`.
- **It is not a payment.** Approve does not execute. The envelope authorizes a use that is not enabled today; check [/docs/agents/status.json](/docs/agents/status.json).
- **A missing signing key fails closed.** Approval returns an error rather than an unsigned approval.

## Related

- [Lifecycle](/docs/agents/concepts/lifecycle): `executableUntil`, read-time expiry, and revocation.
- [Scoped approval](/docs/agents/concepts/scoped-approval): the spend envelope and approval ledger recorded alongside it.