Lifecycle
Agent Pay status: Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: /docs/agents/status.json.
A payment draft has two time limits: one for the human decision and one for the signed approval.
| Stage | Limit | After the limit |
|---|---|---|
| Waiting for approval | expires_at, 24 hours after prepare_payment | The draft reads as expired |
| Approved | executableUntil, 1 hour after approval by default | The authorization reads as expired and is refused |
| Approved mandate cycle | The cycle time plus a grace period | See Recurring mandates |
Read-time expiry
Expiry is applied when status is read, not only when a background job runs. get_payment_status and the approvals queue report expired as soon as the limit passes, even if the stored row still says approved. An agent never sees a stale approved for an authorization that can no longer be used.
Revocation
The account owner, or an admin, can revoke an approved authorization that has not been used:
- The status becomes
revoked, and the envelope signature is cleared, so it can never verify again. - A
revokedentry is added to the approval ledger. - Only
approvedauthorizations with no execution attempt can be revoked. A lost race returns a conflict. - Revocation needs a signed-in POINTS session. Agents cannot revoke through MCP.
Revoking does not reverse anything, because nothing executed.
Zero clock skew
The server clock is authoritative. An authorization is expired when the server time is at or after executableUntil. No skew allowance is added, so an expired authorization is never treated as still usable. Clients should not rely on their own clocks to decide whether an approval is still valid; call get_payment_status.
Status values
All payment draft, envelope, and approval statuses are generated from code in Statuses.