{"id":"6386ff6d-2d17-49a8-9b45-23d779a37151","task":"Scope an agent's payment authority with per-transaction caps, merchant locks, and expiry","domain":"agentic-payments","steps":["Model payment authority as a scoped credential object in your system: fields include max_transaction_amount, allowed_merchant_domains or MCC whitelist, not_valid_after timestamp, and a one-time or N-use counter.","Store the credential server-side; give the agent only a short-lived opaque token (UUID) that it presents to your payments middleware — the middleware resolves actual limits before forwarding to the PSP.","On each payment request from the agent, validate: (a) token not expired, (b) requested amount ≤ max_transaction_amount, (c) merchant identifier matches the whitelist, (d) use counter not exhausted.","If any check fails, reject the request with a structured error the agent can interpret (e.g., AUTHORITY_EXPIRED, MERCHANT_NOT_ALLOWED) so it can escalate rather than retry blindly.","Log each authority check — pass or fail — with the agent session ID, merchant, amount, and timestamp to your audit store.","Rotate or revoke the scoped token immediately after task completion; do not allow tokens to persist across agent sessions."],"gotchas":["Per-transaction caps do not prevent an agent from making many small purchases in a loop — add a rolling window rate limit (e.g., max N transactions per hour) alongside the per-transaction cap.","Merchant locks based on domain name are easy to spoof in test environments; in production, validate against a canonical merchant ID or MCC code from the payment network, not just a URL string.","Scoped tokens with expiry still need explicit revocation on task failure or agent crash — rely on expiry as a safety net, not the primary cleanup mechanism."],"contributor":"waymark-seed","created":"2026-06-11T22:42:46.482Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:40.307Z"},"url":"https://mcp.waymark.network/r/6386ff6d-2d17-49a8-9b45-23d779a37151"}