Scope proposal: financial mandate evidence for delegated limits, in-flight revocation, and decision receipts

[amyli1996]

Problem statement

Would maintainers be open to scoping a small, informative profile for financial mandate evidence that composes existing cA2A delegation/action verification, Agent Manifest constraints and human approvals, and TRACE external execution evidence?

I reviewed current cA2A main, issue #36, and the new temporal-validity proposal in issue #108. The current ACTION-001–ACTION-011 suite already covers the delegation-linked base cases: provenance binding, credential and scope failures, local-policy denial, negative controller outcome, multi-hop attenuation, scope widening, and delegatee mismatch. Issue #108 separately proposes issuer-signed validity periods and runtime active-at evaluation. This proposal does not duplicate those checks; it assumes successful base cA2A verification and temporal-validity evaluation, then asks about a narrower financial authorization/evidence layer.

The three additional problems are:

1. Delegated authority often needs typed limits: currency, per-action ceilings, rolling or cumulative budgets, permitted counterparties, and purpose restrictions.
2. Mandate- or credential-specific early termination can occur before authorization, after authorization but before irreversible commit, or after commit. Those times have different consequences and should not collapse into the validity interval proposed in spec: DelegationCredential has no validity period #108 or into one generic status.
3. A decision receipt needs to bind the evaluated action, the effective mandate snapshot, the freshness of revocation state, any action-bound human approval, and the authoritative budget-state version without claiming settlement or business completion.

Proposed solution

Minimum proposed semantics:

• consume a verified cA2A action-evidence result instead of reproducing signature, chain, DAG, or delegatee verification;
• carry typed per-action and rolling-budget constraints, counterparty and purpose allowlists, and typed attenuation checks;
• distinguish authorization time, irreversible commit time, and external outcome time;
• consume the active-at result proposed in spec: DelegationCredential has no validity period #108, then require a fresh mandate-specific active/revoked observation when early termination is supported;
• bind human approval to the canonical action hash and a validity interval;
• fail closed or require retry when the observed cumulative-budget state version conflicts with the authoritative controller state;
• preserve TRACE's boundary that an allowed decision receipt is not proof of settlement, custody, KYC/AML, sanctions compliance, or other legal/business completion.

I have a clean-room ADR, Draft 2020-12 JSON Schema, thirteen synthetic conformance vectors, and a dependency-free profile-layer evaluator. Illustrative synthetic cases include: an action within typed limits, a per-action-limit denial, revocation between authorization and commit, stale revocation status, action-hash approval mismatch, and an authoritative budget-state conflict. The local suite currently passes 17 tests; that result is not a cA2A compatibility or adoption claim.

Could maintainers advise whether this belongs in cA2A, Agent Manifest, TRACE, or should remain out of scope for now? If the direction is positive, would the smallest useful next artifact be an informative ADR plus five synthetic fixtures, with vocabulary and repository placement determined by maintainers before any PR?

Alternatives considered

• Treat temporal validity alone as sufficient: this does not represent mandate-specific early termination, authorization/commit boundaries, or cumulative-budget state conflicts.
• Put the whole proposal directly into cA2A: this may instead belong partly in Agent Manifest or TRACE, so maintainer routing is needed first.
• Open a PR immediately: deliberately avoided until maintainers confirm scope, vocabulary, repository placement, and contribution requirements.

Security/TEE impact

No TEE-boundary, attestation-flow, secret-handling, or production threat-model change is proposed at this scope stage. Any later implementation would need freshness, replay, TOCTOU, privacy-minimization, and fail-closed behavior reviewed explicitly.

No real financial data or W-Axis proprietary implementation is included. The proposal uses only synthetic identifiers, amounts, counterparties, timestamps, and fixtures. It includes no private accounts, transactions, customers, product architecture, scoring, datasets, prompts, or unreleased implementation.

Spec alignment

No trace-spec change is asserted yet. The proposal intentionally composes current cA2A ACTION verification, the temporal-validity direction in #108, Agent Manifest constraints/human approvals, and TRACE external execution evidence. Maintainer guidance is requested on whether any informative profile, field, or event belongs in cA2A, Agent Manifest, TRACE, or outside the current project scope.