The Bundesbank defines the job of the authorization layer in one sentence: it determines by whom and under what conditions a payment mandate is granted to which AI agent, and how that mandate can be encoded, reviewed and revoked in a machine-readable manner.
Unpack that sentence and you get five fields. Whatever protocol eventually carries the mandate, and whatever the product calls it in the user interface, these five have to be present or the mandate is not usable by a payment service provider.
The five fields
1. Principal. Who is granting authority. A natural person, a business, or in multi-agent setups another agent acting under its own mandate. The principal must be verifiable; this is where the mandate meets identity.
2. Agent. Which agent receives the authority. Not a product name but a uniquely identifiable instance. The Bundesbank's rule: mandates can only be issued to uniquely verifiable agents.
3. Scope. What the agent may do. Purchase categories, merchants or merchant classes, the intent it is pursuing. Scope is what distinguishes a grocery restock agent from a general-purpose one.
4. Limits. How much and how often. Per-transaction ceiling, period ceiling, permitted instruments and rails, permitted currencies, time windows. Limits are what make the authority bounded rather than open.
5. Lifecycle. Expiry, review points and revocation. How the principal sees what was done under the mandate, how they withdraw it, and what happens to in-flight transactions when they do.
Three observations on the fields
Scope and limits are different things. A mandate with a €200 monthly ceiling and no scope lets the agent spend €200 on anything. A mandate scoped to a supermarket and a pharmacy with no ceiling lets it spend without limit in those two places. Products that collapse the two into a single slider are hiding a decision the user needs to make.
Lifecycle is the field most often left out. Every existing mandate-like instrument has a weak revocation story. Card-on-file is revoked by cancelling the card. Direct debit is revoked through the bank, and the creditor finds out afterwards. An agent mandate needs revocation that reaches the agent and the downstream providers before the next transaction, not after.
Machine-readable is doing a lot of work. A mandate expressed in natural language in a chat window is an instruction to the agent. A mandate that a payment service provider can verify, log and audit without a human reading it is something else. The Bundesbank's phrase is encoded, reviewed and revoked; all three verbs have to work without a person in the loop. I wrote about what happens when a platform writes the mandate on the customer's behalf, in Shopify Just Wrote the Mandate for a Billion Listings. The fields were all there. The principal never signed.
The agent mandate against what exists today
Read the last row first. In the two existing instruments, the party that decides each payment is the party being paid. In the agent mandate, the party that decides is software acting for the payer. That is why the other four rows have to carry so much more than they do today.
A direct debit mandate names a creditor and an account. An agent mandate has to describe behavior.
Next lesson: where the mandate sits in the six-layer architecture, and the three protocols that carry mandates today.