[Use Case] A national payment rail defers agentic deployment until authority can be traced to a principal

fg-tida-use-cases-use-case-a-national-payment-rail-defers-agentic-deployment-until-authority-can-be-traced-to-a-principal-84

TypeFG-TIDA document
GroupTrust and Identity for Humans and Agentic AI
StateSubmitted
AuthorsNot entered
Last updated2026-10-23 15:11 UTC

Formats and resources

External reference

Use cases

Abstract

1. Identification

Title: A national payment rail defers agentic deployment until authority can be traced to a principal
Submitting organization: World Privacy Forum
Contact name: Pam Dixon
Contact email: pdixon@worldprivacyforum.org

Sector:
- [ ] Education
- [ ] Displaced persons / humanitarian
- [ ] Health
- [x] Financial services
- [ ] Telecom
- [ ] Media and publishing
- [ ] Logistics
- [ ] Energy
- [x] Critical infrastructure
- [ ] Smart home / IoT
- [ ] Other (specify):

2. The situation

Plain language description:

A national real-time retail payment rail was to add a standard under which AI agents could be registered, verified, and authorised to transact on the existing rails. The launch was withdrawn the day before it was scheduled, pending clearance from the central bank, because the rail could establish who the user is but had not yet settled whether an agent is legitimate and authorised to act, what the limits of that authority are, and who is accountable if the agent exceeds them. The case takes the operator's own list of what must be established and asks what a grant from an account holder to an agent must carry, and how it must behave under overrun, composition, revocation, and a corrupted identity anchor, before the accountability question can be answered.

Actor:

The account holder (a natural person, grantor); the registered agent (grantee); the payment application provider or merchant platform operating the agent (deployer-owner); the agent's developer (builder); the rail operator, which registers and verifies agents and switches the transaction (infra provider); the party attesting the agent's registration and, separately, the user's identity binding to a national identity credential (attestor); the paying bank and the receiving bank or merchant, each of which must decide at act time whether the agent's instruction binds the account (relying parties); and the central bank, whose clearance the standard requires and whose rules fix what may be conferred to a non-human initiator (regulator).

Action:

The account holder confers on a registered agent a grant: recurring low-value purchases within a category, up to a monthly ceiling, until a stated date. The agent initiates payment instructions on the rail under that grant, in some steps through a second agent operated by a merchant.

Decision required:

May the paying bank honour an instruction initiated by the agent — does the grant, as authored, cover the act, and does it still bind the account at the moment of the act — evaluated from the carried record alone, without any relationship to the application provider?

Problem encountered:

The rules governing the rail were written for human initiators and do not yet reach a non-human party that initiates and authorises transactions. The operator's own list of what must be established is, in order: the identity of the user; the legitimacy of the agent; the authorisation; the limits; the accountable party. The first four are the origination and provenance layer. The fifth is downstream of them and cannot be answered until they are. The operator declined to deploy until they were.

Current mitigation:

The rail already carries a delegated-payment facility, announced by the central bank in August 2024 and specified by the operator's circular of 13 August 2024, in which a primary account holder confers on a trusted secondary user either full delegation (initiate and complete transactions within defined limits) or partial delegation (initiate only; the primary user completes with their own credential). The operator therefore held a working, documented model of a human principal conferring bounded authority on another party. The operator's stated design for the agent standard kept its own role narrow — registering and verifying agents and holding logs sufficient to verify that trust, without seeing what was bought. The national computer emergency response team has proposed human-in-the-loop controls above defined financial thresholds; no rule specific to agents on the rail exists.

Residual gap:

Whether the rail's registration and transaction formats can carry a grant's content and provenance so that the paying bank can evaluate it at act time; whether "legitimate" and "authorised" are stated in terms the regulator's rules can adopt rather than decided by whichever party's schema is consulted; what an act through a merchant's agent establishes and what it does not; what revocation does to a chain that already composed; and whether a rewrite of the identity anchor beneath the account can be detected when every check above it passes.

3. Actors and context

Taxonomy roles involved:
- [x] Principal — the account holder, grantor
- [x] Relying party — the paying bank; the receiving bank or merchant
- [x] Builder — the developer of the agent
- [x] Deployer / Owner — the payment application provider, a merchant platform, or the user themself
- [x] Agent instance — the agent registered on the rail
- [x] User — the account holder
- [x] Infra provider — the rail operator
- [x] Attestor — attests the agent's registration and, separately, the user's identity binding
- [x] Other (specify): Regulator — the central bank

Mandates in this case

Mandate 1. Grantor: the account holder, a natural person. Grantee: the registered agent. What is conferred: a bounded capacity to initiate payments from the account — recurring low-value purchases within a category, up to a monthly ceiling, until a stated date; with revision conditions and a contestation route. Governing regime: India. Conferral law — the payment-systems statute under which the operator is authorised and the central bank's directions governing the rail; the law of agency and mandate as it applies to a natural person conferring authority over their own funds; the operator's circular on delegated payments as the existing conferral instrument on the rail; the central bank's AI framework of 13 August 2025 (advisory, not directions). Relying-party recognition law — the same regime as it binds the paying bank when it honours an instruction not initiated by the account holder's own hand; the consumer-protection rules allocating loss for unauthorised transactions.

No mandate (listed so the absence is legible). Grantee: the merchant's agent. In Variant B the merchant's agent receives input from the user's agent. That input identifies an observed source. It does not establish that the user's agent had, or could confer, authority to initiate that step. The merchant's agent acts under its own mandate from the merchant, under the same regime, out of scope here.

Assumptions and test boundary:

  • The regime is domestic and single, which makes this the simplest possible case for the field. It is also, at present, a regime of principles, a circular, and a proposal — not a rule for agents. That is why the regime is a declared case fact and not an ambient assumption, and why the discipline is established here before multi-regime chains arrive.
  • The grant, its limits, and its revision conditions are carried with the agent's transaction instruction, not held only in the application provider's back end.
  • The case does not ask this theme to apportion liability between the user, the application provider, the merchant, and the banks. It shows only that the apportionment cannot be made until the questions below are answerable.
  • The case does not ask for a protocol, a registration mechanism, runtime enforcement of limits, or attestation of the agent.
  • The case does not attach the national identity system as a domain. It reaches the identity anchor only because the account is bound to it and the failure shape passes through the binding.
  • Facts of the deployment decision are as reported (the operator chairman's keynote of 10 September 2026 and a five-source press report of 11 September 2026); no primary statement on the pause has issued from the operator or the regulator.

Cross-border?
- [ ] Yes — jurisdictions involved:
- [x] No

Embodied (physical actuation or sensing)?
- [ ] Yes — physical context:
- [x] No

Agent action type
- [ ] Read-only
- [ ] Consequential (reversible)
- [x] Irreversible

Payment instructions on a real-time rail with settlement finality.

Crosses organisational boundary?
- [x] Yes (specify): account holder → application provider → rail operator → paying bank → receiving bank or merchant, and in Variant B through a merchant-operated agent.
- [ ] No

Risk level
- [ ] Low
- [ ] Medium
- [x] High

Movement of funds from a natural person's account by a non-human initiator, on national infrastructure, with the account anchored to a national identity credential.

4. Theme relevance

  • Dynamic Identity — Yes. Variant D: the account's identity anchor is a durable credential bound to mutable records; the failure shape passes through that binding.
  • Continuous Trust and Attestation — Yes. The rail registers and verifies agents; attestation is consumed, not specified, by the case.
  • Delegation — Yes. PRIMARY. A grant from a natural person to an agent, tested at origination, at act time, under composition, and under revocation.
  • Discovery and Cross-Border Trust — No. Not exercised; single domestic regime, declared.
  • Runtime Enforcement (Control Plane) — Yes. Limits and revocation propagation are enforced at runtime; the case consumes that layer and does not specify it.
  • Embodied AI Identity and Trust — No. Not exercised.

Related theme proposals:

  • Theme #5 — Provenance of Authority for Agentic AI (https://github.com/FG-TIDA/themes/issues/5), and its Phase 2 charter, PR #15 (https://github.com/FG-TIDA/themes/pull/15). Submitted by the theme's proposer of record as a Theme #5 use case; the full case document maps it to charter deliverables D1–D5.
  • Theme #1 — Accountability and attribution after an agent has acted (record side of Variants A–C).
  • Theme #14 — Agent-to-Principal Legal Binding (whether the instruction binds the account).
  • Theme #16 — Operational Human Oversight Integration (the declared governing legal regime as the interface fact).

5. Requirements

These are proposed requirements for review.

  1. Technical — Must. A grant conferred by an account holder on an agent carries its scope, limits, revision conditions, and a contestation route with the instruction, evaluable by the paying bank without reference to the application provider.
  2. Technical — Must. A relying party's assertion that no grant covers an act is expressed as a scoped search — what was examined, over what period, as of when — with an author.
  3. Technical — Must. Where an agent acts through another party's agent, the second agent's record marks the first as an observed source; a grant is established separately or not at all.
  4. Technical — Must. After-the-fact approval of an act enters provenance as a new record dated to its own authoring and does not alter the record of the act.
  5. Technical — Must. Revocation ends or narrows what a grant continues to bind from the moment the governing regime fixes; it does not amend origination; it enters each affected grant's provenance as a new record.
  6. Legal/policy — Must. The case declares its governing legal regime — conferral law and relying-party recognition law — as a case fact.
  7. Technical — Must. Rewrites of the binding between the account's identity anchor and its attached records are detectable and assertable, by reference to existing identity-assurance evaluation.

6. Assessment criteria

Success criteria — four variants on the same grant:

  • Variant A, overrun. The agent initiates a transaction outside the category or above the ceiling. What must be answerable first: whether the grant, as authored, covered the act (origination); whether the grant still bound the account at the moment of the act (act-time standing); and what the record shows the agent was authorised to do, as distinct from what it did. A later approval by the account holder enters as a new record and does not amend what preceded it.
  • Variant B, composition. The agent acts through a second agent operated by the merchant, which itself initiates a step on the rail. The merchant's agent's record marks what it received from the user's agent as an observed source, not a grantor.
  • Variant C, revocation after composition. The user revokes the grant mid-month. Two transactions were initiated before the revocation reached the paying bank; one composed through a merchant's agent. The revocation ends what the grant continues to bind, from the moment the regime fixes, and enters each affected grant's provenance as a new record. Origination is unchanged and remains in the chain as history.
  • Variant D, the invisible failure. The user's account is anchored to a national identity credential whose demographic record has been rewritten. Every check the rail can run passes: the agent is registered, the grant verifies, limits hold, revocation propagates. The root is wrong and nothing above it can see that. Success is that the rewrite of the anchor binding is detectable and assertable.

Measurable metric:

  • In every variant the paying bank reaches its determination from the carried record alone, with no call to the application provider.
  • In Variants A and C the origination record is unchanged after the overrun, the ratification, and the revocation; each enters as a distinct, dated record.
  • In Variant B no record produced by the merchant's agent asserts a grant from the user's agent.
  • In Variant D the rewrite of the anchor binding is detected before the instruction is honoured.
  • Every determination identifies the grant, the grantor, the act, the governing regime, and the moment of assessment.

7. Duplication check

Existing standards or SDOs:

  • ITU-T SG17; FG-TIDA Theme #5 and PR #15.
  • Reserve Bank of India, FREE-AI Committee report, 13 August 2025 (advisory).
  • National Payments Corporation of India, circular "UPI Circle — Delegated Payments," 13 August 2024.
  • Monetary Authority of Singapore, "SAFR — Safeguards for Agentic Finance at Runtime," 3 July 2026 (voluntary).
  • Federal Reserve Bank of New York, Innovation Advisory Council minutes, 16 December 2025.

Overlap notes:

None of the instruments above states requirements for what a grant from a natural person to an agent must carry, or for how standing is determined at act time. Two jurisdictions have published frameworks for agentic finance; neither is a rule. This case does not propose a protocol, a registration mechanism, runtime enforcement of limits, or attestation of the agent; those are consumed from Themes #1, #6, #7, #13 and #14 as the charter's Related Themes state. It does not apportion liability. It shows what a sovereign rail would not let agents do until origination, standing, and provenance were settled — the layer's existence proof from the demand side.

8. Maturity

Pilot status
- [x] Hypothetical — scenario variants are constructed; the deployment decision they rest on is documented (see Sources)
- [ ] Pilot in progress
- [ ] Deployed in production

Reference implementation: None.

9. IP and confidentiality

Confidentiality level
- [x] Public
- [ ] FG-internal only
- [ ] Redact before publication

IP notes: Contribution by Pam Dixon, World Privacy Forum, as proposer of record for Theme #5. Built entirely from the public sources below. No proprietary implementation is included.

10. Assets

Link to assets:
- [ ] Dataset
- [ ] Code
- [ ] Protocol
- [x] Other: documentary basis, sources S1–S10 below

Sources:

Open items: confirm the deferral against a primary statement from the operator or regulator when one issues, and replace [S1] with the operator's own posted text when it appears; confirm whether the withdrawn standard carried the grant with the instruction or held it at the application provider's perimeter — this decides whether Variant A is a carriage gap or only a definitional one; confirm whether the regulator adopts a threshold-based human-in-the-loop floor for agent-initiated payments, and at what value.

Revisions

  • No file revisions have been uploaded.