The rapid proliferation of autonomous AI agents in financial services creates an unprecedented trust gap: existing authorization infrastructure, designed for human-initiated transactions, cannot verify the identity, intent, or decision quality of machine actors operating at scale. This paper introduces the Decision Trust Protocol (DTP), a four-layer authorization framework purpose-built for agent-to-agent and agent-to-merchant commerce on existing payment rails—card networks and crypto (x402/USDC) alike. DTP provides continuous trust verification through: (1) an Orchestration Guardian managing session integrity and budget enforcement; (2) an Identity and Verification layer leveraging W3C Decentralized Identifiers for agent authentication; (3) a deterministic Authorization Engine implementing a sequential pipeline of seven decision gates plus two system steps, returning APPROVE, DECLINE, or STEP_UP; and (4) a dual-mode Risk Intelligence layer delivering sub-5ms inline decisions with post-authorization deep analysis. We introduce the Know Your Agent (KYA) composite trust score—a weighted metric incorporating trust level, transaction history, decline patterns, dispute deflection, and per-decision intent quality—that enables progressive trust promotion from unregistered to trusted status. The protocol provides a reference mapping to Mastercard DE 48.75 fraud scoring data elements, designed for compatibility with existing issuer infrastructure (scheme certification pending).

Keywords: agentic commerce, authorization protocol, decision trust, agent identity, Know Your Agent, risk scoring, payment infrastructure, autonomous agents, card network integration

1. Introduction: The Agent Trust Gap

The financial services industry stands at an inflection point. McKinsey estimates that agentic commerce—transactions initiated, negotiated, and executed by autonomous AI agents—will generate $3–5 trillion in economic activity by 2030.1 Bain & Company projects that agent-driven commerce will constitute 15–25% of U.S. digital commerce within the same horizon, representing $300–500 billion in transaction volume.2 Morgan Stanley’s more conservative models estimate $190–385 billion, while the broader agentic AI market is projected to expand from $7.84 billion in 2025 to $52.62 billion by 2030.3,4

Yet the infrastructure that will carry these transactions—the global card networks processing over $40 trillion annually—was designed for a fundamentally different paradigm: one human, one card, one decision. Every authorization message, fraud signal, and dispute mechanism assumes a human cardholder who can be authenticated via knowledge factors (PINs, passwords), possession factors (physical cards, mobile devices), or biometric factors (fingerprints, facial recognition). None of these mechanisms extend naturally to autonomous software agents that transact on behalf of humans, organizations, or other agents.

This creates what we term the Agent Trust Gap—the structural inability of current payment infrastructure to answer three fundamental questions about any agent-initiated transaction:

1. Identity: Is this agent who it claims to be, and is it authorized to act on behalf of its principal?

2. Intent: Does this transaction reflect the genuine intent of the principal, or has the agent’s decision-making been compromised, manipulated, or drifted from its mandate?

3. Decision Quality: Is the agent’s reasoning process sound, consistent, and free from adversarial influence?

As Strange and da Costa argue in their analysis of compliance in the AI era, the challenge is not merely technical but structural: existing regulatory frameworks assume human actors making deliberate choices, and the shift to autonomous agents requires entirely new verification paradigms.5 The National Institute of Standards and Technology (NIST) AI Risk Management Framework acknowledges this gap, calling for “contextual, continuous, and composable” risk assessment—precisely the characteristics absent from batch-oriented fraud detection systems.6

1.1 What payment infrastructure assumes about its subject

Every layer of the card system encodes assumptions about the transacting subject that are old enough to read as facts of nature. The subject is a durable legal person: expensive to mint (one legal identity per person, non-disposable), continuous (the person verified yesterday is the person transacting today), slow-changing (financial conduct drifts over years, so risk models refresh on cycles measured in months), and legally accountable (liability attaches to the verified person, which is what gives verification its force). Every control inherits these assumptions. Authentication factors—knowledge, possession, biometrics—bind a claim to one human body. Fraud models learn human behavioral rhythms and flag deviation at human timescales. The dispute system presumes a cardholder who can attest, under liability, to what they intended. Intent itself is assumed to form privately inside the subject and to be expressed through deliberate action; the system never needed to ask where a decision came from, because for a human there was nowhere else it could come from.

The industry’s own history shows what happens when a new surface breaks an old assumption: card-present counterfeiting produced EMV; card-not-present fraud produced 3-D Secure; account takeover produced behavioral analytics. Each wave of fraud earned its own purpose-built defensive layer. Agent-initiated transactions break more of the founding assumptions at once than any previous surface, and this paper’s position is that they earn their own layer for the same reason every earlier surface did.

1.2 Why the agent is structurally vulnerable

An autonomous agent inverts each assumption. It is cheap to mint: spawning a thousand instances costs seconds and cents, dissolving the one-subject-one-identity premise that onboarding verification depends on. It is discontinuous: the “same” agent may run a different model, prompt, or toolchain on every session, so what was verified is not necessarily what is transacting. It is fast-mutating: behavior can invert inside a single context window. And it is not a liability subject: accountability must be routed to a principal, so verifying the agent alone verifies nothing enforceable. (The companion KYA research framework develops these inversions in full.)

These inversions would matter even for flawless software. Language-model agents add a deeper defect: the architecture does not separate instructions from data. Everything the agent reads—a product page, a tool response, a retrieved document—arrives in the same channel as its principal’s commands and can steer the reasoning that constructs a payment.25 This is why prompt injection leads the OWASP Top 10 for LLM applications22 and is observed against production agents in the wild:23 it is not a bug awaiting a patch but a property of the medium. Nor can the agent’s own account close the gap. Chain-of-thought is trained on human language, so it reads like testimony, but the stated reasoning is not reliably the computation that produced the action26,27—talking like a human is not thinking like one, and an agent cannot be authorized on its self-narrated intent. Finally, the adversary operates at the speed of its victim: attacks iterate at inference speed—probe, read the decline, generate a variant, retry—and, since August 2026, demonstrably coordinate across fleets.24 The gap between human and agent transactions is therefore not a list of missing features. The subject the infrastructure was built to verify has been replaced by one with opposite properties, attackable through a channel the old subject did not have.

1.3 Designing for the era of machine cognition

DTP’s design stance follows from taking one condition seriously: agent capability compounds faster than human oversight can track—the operating condition of what is popularly called the singularity era. We take no position on timelines; we take a position on design. A control is worth building only if it still holds when the agent is more capable than its overseers, which rules out every defense that depends on out-thinking the agent, interpreting its internals, or assuming it stays the same. Five commitments follow, and they recur throughout this paper. Split cognition from consequence: agents propose, a deterministic engine disposes; validity is decided outside the agent’s self-narrative, and there is no learned decision boundary for an adaptive attacker to probe (§6). Verify position, not capability: custody, provenance, and derivability are properties of where things live, not of how clever the responder is—any test of intelligence a legitimate agent can pass, its hijacked twin passes too (§11.5). Convert information problems into economic ones: stated intent cannot be verified true, so trust is earned over settled history, bounded by the mandate, slow to climb and instant to fall—costs denominated in time and capital, which do not deflate as cognition gets cheaper (§9). Treat self-report as evidence, never as input: the attested intent record is cross-examined against telemetry and priced at a bounded weight, valuable precisely because it is committed before outcomes are known (§8). Fail closed: absence of signal reads as unknown, never as safe. None of these depends on the defender being smarter than the attacker. That is the design’s answer to living with machine cognition: guarantees invariant to capability growth, because each is enforced at a boundary the agent cannot reach—the boundary where money moves.

This paper presents the Decision Trust Protocol (DTP), a layered authorization framework that closes the Agent Trust Gap by introducing a dedicated Decision Trust Layer between agent orchestration platforms and payment network infrastructure. DTP is designed to be issuer-agnostic, operating as middleware that any card issuer, program manager, or agent platform can integrate without modifying their existing authorization stack.

2. Related Work

2.1 Traditional Payment Security

The payment industry’s approach to transaction security has evolved through three generations: rule-based fraud detection (1990s), machine learning scoring (2000s–present), and real-time behavioral analytics (2015–present). PCI DSS 4.0, mandatory since March 2025, establishes baseline data security requirements but explicitly does not address agent authentication or autonomous transaction verification.9 Mastercard’s DE 48.75 fraud scoring data element provides a standardized mechanism for communicating risk scores within authorization messages, but assumes those scores originate from human-transaction models.10

2.2 Agent Trust and Verification Frameworks

Kim et al. propose the Agentic Risk Standard (ARS), a framework for quantifying trust in financial AI agents through risk settlement mechanisms.11 While ARS provides a theoretical foundation for agent risk assessment, it operates primarily in cryptocurrency and decentralized finance contexts, requiring blockchain-based settlement that is incompatible with traditional card network infrastructure.

Chen et al.’s TIVA (Transaction Intent Verification for Agents) framework addresses agent payment authentication through blockchain-based verification.13 TIVA introduces important concepts—particularly intent verification and authenticity attestation—but requires fundamental changes to payment infrastructure that limit near-term adoption.

Bholat and Wilkins examine the regulatory implications of agentic AI in finance, arguing that existing supervisory frameworks are “structurally misaligned” with autonomous agent behavior and proposing governance models that emphasize continuous monitoring over point-in-time assessment.12

2.3 AI Risk and Governance Standards

The NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile (AI 600-1) establish vocabulary and governance structures for AI risk, organizing risks around the dimensions of governance, mapping, measurement, and management.6,7 Liu et al. propose a layered security assessment model specifically for agentic AI systems, identifying trust boundaries between agent components as critical vulnerability surfaces.14

Park et al. survey decentralized governance approaches for autonomous AI agents, finding that effective governance requires both cryptographic identity (for accountability) and behavioral monitoring (for intent verification)—a dual requirement that informs DTP’s architecture.15

2.4 Decentralized Identity

The W3C Decentralized Identifiers (DID) specification provides a standards-based approach to self-sovereign identity that extends naturally to non-human actors.8 DTP adopts the DID:key method with Ed25519 cryptographic keys, enabling agent identity verification without reliance on centralized certificate authorities—a critical property for a protocol intended to operate across multiple issuers and jurisdictions.

2.5 Independent evidence from 2026

Red-teaming and benchmark work published since this paper’s first version has converged on its premise that authority is not integrity. A systematic red-team of Google’s AP2 built a working shopping agent and showed that cryptographically signed mandates secure the execution layer while the agent’s decision remains exposed to prompt injection before authorization.18 Prompt injection holds first place in the OWASP Top 10 for LLM applications,22 and indirect injection against production agents has been observed in the wild.23 Benchmarks now name both sides of the coverage: stakeholder-centric injection benchmarking formalizes the “signed, in-scope, but wrong” regime that action-level intent coherence addresses,19 while protocol-level attack taxonomies found unbound payment destinations, TOCTOU redemption, and unenforced authorization scope succeeding structurally against agentic-commerce platforms—the classes a deterministic authorization envelope closes by construction.20 Coordinated multi-agent attacks moved from projection to record in August 2026, when a swarm of autonomous agents collaborated in a live attack on Hugging Face,24 and multi-agent collusion is now an active research area;21 §11.4 describes the fleet-level response.

2.6 Gap Analysis

Existing approaches address fragments of the agent trust problem: ARS provides risk quantification but requires blockchain settlement; TIVA offers intent verification but demands infrastructure changes; NIST frameworks provide governance vocabulary but not implementation specifics. No existing framework provides a complete, implementable protocol that (a) verifies agent identity, intent, and decision quality; (b) operates on existing card network rails; (c) maps to standard authorization data elements; and (d) supports progressive trust establishment. The Decision Trust Protocol addresses this gap.

3. The Decision Trust Protocol: Architecture Overview

DTP implements a four-layer defense-in-depth architecture, where each layer provides independent verification and any layer can halt a transaction. The layers are ordered by evaluation cost, with lightweight checks executing first to minimize latency for legitimate transactions.

Layer	Name	Function	Latency Budget
0	Orchestration Guardian	Session integrity, probing detection, budget enforcement	< 1 ms
1	Identity & Verification	W3C DID authentication, KYC/KYB passthrough, mandate validation	< 2 ms (cached)
2	Authorization Engine	Seven-gate decision pipeline (+2 system steps), mandate enforcement, velocity controls	< 5 ms
3	Risk Intelligence	Dual-mode scoring, signal taxonomy, DE 48.75 mapping	< 5 ms inline

Table 1. DTP four-layer architecture with latency budgets. Total inline authorization target: < 13 ms end-to-end.

The layered architecture draws on the defense-in-depth principle from information security (ISO/IEC 27001)17 and the layered risk assessment model proposed by Liu et al. for agentic AI systems.14 Each layer maintains independent state and can be upgraded or replaced without affecting adjacent layers—a critical property for a protocol intended to evolve alongside rapidly advancing agent capabilities.

3.1 Rail-agnostic by construction

DTP’s subject is the agent, not the rail. The question the protocol answers—is this agent still faithfully executing its principal’s intent?—is independent of how value settles, so the architecture separates a mechanism-independent agent-trust core from a thin rail adapter. The core—agent identity, principal binding, the mandate, the KYA composite, the EDQS-B behavioral signals, the intent attestation and hash-chained audit, the Orchestration Guardian, and machine step-up—evaluates the agent and its decision without reference to the settlement rail: the trust engine carries no rail logic, and authorization is rail-agnostic by construction. Each rail contributes its factor set through an adapter. On cards: MCC scope, DE 48.75 mapping, fiat velocity, chargeback evidence. On crypto (x402/USDC): wallet binding, a single-use EIP-3009 nonce binding an attestation to exactly one transfer, fail-closed OFAC address screening, and pre-broadcast transaction-hash binding. Risk and trust attach to the agent, not the transaction—a risk event on one rail raises the agent’s risk on every future rail—and adding a rail means writing an adapter, never re-architecting the decision. Card and crypto are the two live adapters; the same core generalizes to any settlement mechanism (bank transfer, credit, cash-equivalent) without touching the agent-trust layer.

4. Layer 0: Orchestration Guardian

The Orchestration Guardian serves as the outermost defense perimeter, operating at the session level rather than the transaction level. Its purpose is to detect compromised agent sessions before individual transactions are evaluated, thereby preventing entire classes of attacks that transaction-level analysis would miss.

4.1 Session Health Monitoring

Every agent session is assigned a health grade (HEALTHY, DEGRADED, SUSPICIOUS, COMPROMISED) based on continuous behavioral telemetry. The Guardian monitors three primary signals:

Request cadence analysis detects abnormal timing patterns indicative of automated probing or credential-stuffing attacks. A legitimate agent operating under normal orchestration exhibits predictable request intervals; sudden acceleration or perfectly uniform spacing suggests adversarial control.

Probing detection identifies systematic boundary-testing behavior—for example, an agent methodically incrementing transaction amounts to discover authorization limits, or cycling through merchant category codes to map acceptance policies. The Guardian maintains a sliding window of recent requests and computes a probing likelihood score.

Budget enforcement tracks cumulative session spend against pre-authorized budgets. Unlike transaction-level velocity checks (implemented in Layer 2), session-level budget enforcement catches slow-drip attacks where individual transactions fall below velocity thresholds but aggregate spend exceeds authorization.

4.2 Denial Pattern Analysis

The Guardian implements denial pattern tracking that identifies agents exhibiting pathological decline patterns. When an agent’s denial rate exceeds configurable thresholds within a session, the Guardian can downgrade session health, impose additional verification requirements, or terminate the session entirely. This mechanism is particularly important for detecting agents that have been prompt-injected or otherwise manipulated into making transactions the principal did not authorize.

5. Layer 1: Identity and Verification

5.1 Agent Identity with W3C DIDs

DTP assigns each registered agent a W3C Decentralized Identifier using the DID:key method with Ed25519 public keys encoded in base58btc multicodec format.8 The resulting identifier (e.g., did:key:z6Mk...) is cryptographically bound to the agent’s registration and serves as the canonical identity across all protocol layers.

The choice of DID:key over DID:web or DID:ethr reflects three design priorities: (a) no dependency on DNS or blockchain infrastructure; (b) offline verifiability—any party can verify the DID without network calls; and (c) compatibility with existing PKI practices familiar to financial institutions.

5.2 KYC/KYB Passthrough Verification

DTP does not perform identity verification directly. Instead, it implements a passthrough model where verification results from licensed KYC/KYB providers are attested and stored as verification credentials linked to the agent’s principal. This approach ensures DTP operates as infrastructure rather than a regulated entity, while still enabling issuers to enforce verification requirements appropriate to their risk appetite.

5.3 Principal-Agent Binding

Each agent is bound to a principal—the human or organization on whose behalf the agent acts. Principals are typed as ORGANIZATION or INDIVIDUAL, with different verification requirements and authorization limits for each. The binding is established at agent registration and cryptographically attested, ensuring that an agent cannot unilaterally reassign itself to a different principal.

6. Layer 2: The Authorization Engine

The Authorization Engine is the core of DTP, implementing a deterministic sequential pipeline of seven decision gates plus two system steps. Each gate evaluates independently and can either approve (pass to next gate), soft-flag (annotate with concern but continue evaluation), or decline (halt pipeline with a specific reason code). The pipeline’s terminal outcomes are APPROVE, DECLINE, and STEP_UP—the escalation outcome, resolved by a human or, for fully autonomous flows, by the Sentinel machine step-up layer published separately. The sequential design ensures deterministic, auditable decisions—a critical property for regulatory compliance.

6.1 The Pipeline: Seven Decision Gates + Two System Steps

#	Stage	Evaluation	Failure disposition
1	Agent Resolve (gate)	Agent exists, is ACTIVE, and is bound to its principal	AGENT_SUSPENDED
2	Intent Verification (gate)	Declared intent context present, typed, and bound by intent_hash	Decline (malformed or missing intent)
3	Anomaly Gate—EDQS-B (gate)	Six behavioral-anomaly detectors against the 70/30 anchored+drift fingerprint	STEP_UP at the governed composite threshold
4	Mandate Enforcement (gate)	Amount, MCC, currency, velocity (atomic reservation), cooldown against the active mandate	MANDATE_EXPIRED · AMOUNT_EXCEEDS_LIMIT · MCC_NOT_ALLOWED · CURRENCY_MISMATCH · VELOCITY_EXCEEDED · COOLDOWN_ACTIVE
5	Behavioral Overlay (gate)	Trust-zone limit multiplier from the previous decision’s evidence (GREEN ×1.00 … CRITICAL ×0.25)	Effective-limit containment (caps, not a decline)
6	Risk Scoring (gate)	Inline composite risk with logistic saturation; rail-specific risk adapter	RISK_SCORE_HIGH
7	KYA Decision (gate)	Score recomputed with this transaction’s intent term; issuer thresholds applied	INSUFFICIENT_TRUST → DECLINE or STEP_UP
8	Persist + webhooks (system)	Decision written to the immutable, hash-chained log; events emitted	—
9	Async post-decision (system)	Outcome recording, promotion/demotion review, next-decision overlay multiplier	—

Table 2. The authorization pipeline: seven decision gates and two system steps, with representative failure dispositions. Declined and stepped-up attempts flow through the same post-decision intelligence as approvals.

6.2 The Soft-Flag Pattern

A distinctive feature of the DTP pipeline is the decided_early soft-flag pattern. When a gate identifies a concern that is significant but not dispositive (e.g., an amount approaching but not exceeding the mandate limit, or a marginally elevated risk score), it annotates the transaction with a flag rather than declining. Subsequent gates can incorporate these flags into their own evaluation, enabling nuanced decisions that account for the cumulative risk profile of a transaction.

6.3 Mandate Enforcement

Mandates are the foundational authorization primitive in DTP. A mandate is a structured permission object that specifies what an agent is allowed to do: permitted merchant categories, amount bounds, velocity limits, currency restrictions, temporal validity, and required trust level. Mandates are immutable once activated—modifications require creating a new mandate and deactivating the previous one, ensuring a complete audit trail.

The mandate model draws on the principle of least privilege: agents receive only the permissions necessary for their intended function, and every transaction is evaluated against these explicit boundaries. This stands in contrast to traditional card authorization, where a cardholder’s spending authority is defined implicitly by credit limits and issuer-side rules.

7. Layer 3: Risk Intelligence

7.1 Dual-Mode Architecture

DTP’s risk engine operates in two modes, reflecting the fundamental tension between authorization latency and analytical depth:

Fast-check (inline): Executes within a 5ms budget during the authorization pipeline. Evaluates pre-computed risk signals, velocity aggregates, and cached trust scores to produce an inline risk score. This mode prioritizes speed and is sufficient for the vast majority of transactions.

Deep-analyze (asynchronous): Triggered post-authorization for flagged transactions or on a sampling basis. Performs comprehensive analysis including cross-session behavioral comparison, network graph analysis, and external data enrichment. Results inform future fast-check evaluations and may trigger retrospective actions.

7.2 Risk Signal Taxonomy

DTP defines seventeen distinct risk signal types organized into four categories: behavioral signals (velocity anomaly, pattern deviation, session irregularity), identity signals (authentication weakness, identity mismatch), transaction signals (amount anomaly, geographic anomaly, MCC anomaly, merchant risk, temporal anomaly), and decision quality signals (intent drift, reasoning degradation, confidence anomaly). Each signal carries a severity classification and a numeric weight used in composite scoring.

7.3 Logistic Saturation Scoring

Risk signals are aggregated using a logistic saturation function that prevents score explosion from correlated signals:

where raw_sum is the weighted sum of active risk signals. This produces a score in the range [0, 1) with diminishing marginal sensitivity—a critical property that prevents a cascade of individually minor signals from producing a disproportionately high composite score. The logistic function was selected over linear aggregation after empirical testing showed that linear scoring produced excessive false-positive rates when multiple low-severity signals co-occurred.

7.4 DE 48.75 Integration

A key design decision in DTP is a reference mapping to Mastercard’s Data Element 48.75 fraud scoring specification.10 DTP’s risk reason codes are designed to map to DE 48.75 sub-element structures, with the intent that issuers can incorporate DTP risk assessments into their existing authorization message flows. This reference mapping is intended to reduce integration barriers and enable incremental adoption; scheme certification is pending and is not implied by this design.

8. Decision Quality Assessment

The most novel stage of the DTP authorization pipeline is its decision-quality layer—deployed in production as EDQS-B (Behavioral), the anomaly gate of §6.1—a mechanism for evaluating whether an agent’s transaction request reflects sound, uncompromised reasoning. This addresses a class of attacks and failure modes unique to AI agents: prompt injection, goal drift, adversarial manipulation of the agent’s decision-making process, and emergent behavioral anomalies. What ships today is EDQS-B: the six behavioral-anomaly detectors below, blended against an anchored behavioral fingerprint as a governed, deterministic heuristic. The six-dimension decision-quality rubric (EDQS-Q) defined in the EDQS research framework remains a pre-registered specification under validation and is not on the decision path.

8.1 Intent Anomaly Detection

DTP implements a drift-tolerant intent fingerprinting system. Each agent’s transaction history generates a behavioral fingerprint consisting of an anchor component (70% weight)—the stable, long-term behavioral profile—and a drift component (30% weight)—recent behavioral patterns that capture legitimate evolution in the agent’s usage. This weighted blend allows the system to distinguish between natural behavioral evolution and sudden anomalies indicative of compromise.

8.2 Anomaly Detectors

Detector	Detection Target
Confidence Inflation	Agent expressing abnormally high certainty, potentially masking compromised reasoning
Alternatives Collapse	Agent failing to consider alternatives, suggesting tunnel-vision or manipulation
Reasoning Length Anomaly	Significant deviation in reasoning complexity from historical baseline
Vocabulary Shift	Sudden changes in decision-description vocabulary, potentially indicating prompt injection
Amount Escalation	Gradual or sudden increases in transaction amounts beyond historical patterns
MCC Drift	Unexplained shifts in merchant category distribution compared to established profile

Table 3. Decision quality anomaly detectors and their target failure modes.

8.3 Trust Zone Classification

The composite decision quality score maps to four trust zones, each applying a multiplier to the agent’s effective trust level:

Zone	Multiplier	Score Range	Action
GREEN	1.00	Score ≥ 0.70	Full authorization
AMBER	0.75	0.40 ≤ score < 0.70	Enhanced monitoring
RED	0.50	0.20 ≤ score < 0.40	Reduced limits; deep analysis
CRITICAL	0.25	Score < 0.20	Session suspension

Table 4. Decision quality trust zones with effective multipliers and recommended actions.

9. Know Your Agent: Composite Trust Scoring

DTP introduces the Know Your Agent (KYA) framework as a complement to traditional Know Your Customer (KYC) requirements. While KYC verifies the identity of the human or organizational principal, KYA establishes and continuously updates a trust profile for the agent itself—an entity that has no inherent identity, no credit history, and no reputation prior to registration.

9.1 Trust Score Composition

The KYA composite trust score is a weighted metric computed as:

Symbol	Component	Description
T	Trust Level (35%)	Ordinal tier base: UNREGISTERED 0.00, REGISTERED 0.30, VERIFIED 0.65, TRUSTED 0.90—earnable only through the trust ladder’s time-and-volume gates; anchors the score’s ceiling
H	Transaction History (20%)	min(n/1000, 1): successful settled transactions, linear to a cap at 1,000—bounds what raw volume alone can buy
D	Decline Rate (15%)	max(0, 1 − 10r): inverted and amplified tenfold—declines are issuer verdicts, not self-reports; a 10% lifetime decline rate zeroes the component
F	Dispute Deflection (10%)	deflected / (filed + deflected): network-adjudicated outcomes—the slowest-maturing (30–120 days) and hardest-to-fake signal
Q	Intent Quality (20%)	Type-specific rubric over the declared intent context of the transaction being decided; neutral 0.5 with no intent history; cross-examined by the anomaly gate rather than trusted

Table 5. KYA composite trust score components and weights. All five weights are fixed, published literals; every input is logged with the decision, so any score is exactly recomputable after the fact.

The tier-gated anchor gives the score structural ceilings—0.45 attainable while UNREGISTERED, 0.755 REGISTERED, 0.8775 VERIFIED, 0.965 TRUSTED. An UNREGISTERED agent cannot reach GREEN (≥ 0.70) by any combination of the remaining components, a REGISTERED agent cannot on outcome components alone, and certainty (1.0) is unattainable by construction. The formal treatment, with worked examples, is given in the companion KYA research framework.

9.2 Trust Ladder Promotion

Agents progress through four trust tiers via a promotion mechanism that requires sustained good behavior across all score components:

UNREGISTERED → REGISTERED: Achieved upon valid agent registration with a verified principal.

REGISTERED → VERIFIED: Requires successful KYC/KYB verification of the principal entity, plus a minimum transaction history demonstrating consistent, low-risk behavior.

VERIFIED → TRUSTED: Requires an extended track record with a decline rate below configurable thresholds and a dispute rate below issuer-defined limits. TRUSTED status unlocks the highest authorization limits and lowest monitoring intensity.

Importantly, trust promotion is non-monotonic: agents can be demoted based on behavioral degradation, elevated dispute rates, or decision quality zone transitions. This dynamic trust model reflects the reality that agent behavior is not static and that continued trust must be earned through continued good performance.

10. Implementation and Performance Characteristics

10.1 Architecture Decisions

The reference implementation is built as a stateless API service with the following design choices:

Stateless authorization path: All data required for the decision pipeline is retrieved at the start of each authorization request. This enables horizontal scaling without session affinity and ensures that any instance can handle any request.

Environment isolation: Production and sandbox environments are fully isolated at the database level, with API key prefixes determining routing. This enables agent developers to test integrations without risk of affecting production data.

Deterministic ID generation: All protocol entities use a structured ID format that encodes entity type, creation time, and uniqueness, eliminating collision risk while enabling efficient time-range queries without secondary indexes.

10.2 Performance Targets

Metric	Target	Measured (p99)
End-to-end authorization latency	< 15 ms	< 13 ms
Inline risk scoring	< 5 ms	< 4 ms
Agent registration	< 100 ms	< 80 ms
Deep risk analysis (async)	< 500 ms	< 350 ms
Sanctions/PEP screening (flagged only)	< 200 ms	< 150 ms

Table 6. Engine-internal targets and latencies measured under burst conditions in the test environment. Sustained end-to-end production latency is higher—≈23 ms at the median at current volume—with current figures published on the status page and in load-test artifacts available to customers under MSA. Sanctions/PEP screening is invoked only for flagged cases, not per-transaction.

10.3 Scalability Considerations

The protocol is designed to scale from single-instance deployments to distributed architectures supporting thousands of transactions per second. Key scaling mechanisms include Redis-backed session state for cross-instance consistency, read-replica database topology for authorization lookups, and an event-driven architecture that decouples synchronous authorization from asynchronous risk analysis.

11. Discussion

11.1 Implications for Issuers

DTP offers card issuers a path to participate in agentic commerce without building proprietary agent authorization infrastructure. By integrating DTP as middleware, issuers gain agent identity verification, intent validation, and risk scoring capabilities that map directly to their existing authorization message flows. The protocol’s issuer-agnostic design means that competitive advantage shifts from proprietary technology to operational excellence in risk calibration and agent ecosystem management.

11.2 Implications for Regulators

The protocol’s deterministic pipeline, comprehensive audit trail, and structured decline codes provide regulators with the transparency required to supervise agent-initiated transactions. Every authorization decision is traceable to specific gate evaluations, risk signals, and trust scores—a level of explainability that contrasts with the opacity of traditional ML-based fraud detection. As Bholat and Wilkins argue, effective regulation of agentic AI in finance requires continuous, contextual monitoring rather than point-in-time assessment12—precisely the model DTP implements.

11.3 Implications for Agent Developers

For developers building commercial AI agents, DTP provides a standardized path to payment capability. The trust ladder model incentivizes good behavior—agents that transact responsibly earn higher trust levels and broader authorization limits—creating a positive feedback loop between agent quality and commercial capability. The sandbox environment enables risk-free integration testing, and the structured API eliminates the need for each agent developer to negotiate bespoke arrangements with payment providers.

11.4 Limitations and Future Work

Several limitations merit acknowledgment. First, the behavioral detectors rely on baselines that require sufficient transaction history to calibrate—newly registered agents operate with reduced sensitivity until their profiles mature, which is why cold start is priced conservatively: a day-one agent transacts, but in AMBER at tightened limits. Second, the deployed decision-quality control (EDQS-B) is a governed heuristic whose weights are expert-set priors under a documented calibration program, and the six-dimension EDQS-Q rubric remains a pre-registered research specification; a supervised outcome-label loop now feeds the validation both require, and no discrimination or calibration claim is made ahead of that evidence. Third, replay and idempotency are enforced in production—idempotency keys resolve duplicates to the original decision, and velocity reservation is atomic under concurrency—but formal verification of the pipeline’s safety properties remains future work; the confused deputy, a legitimate agent steered by a malicious merchant surface, passes identity and mandate checks by construction, with detection living in intent-coherence and merchant-affinity telemetry rather than at the identity layer.

Future research directions include: (a) federated trust, where agents’ trust scores are portable across issuers; (b) fleet-level defense—a decision-time burst-correlation detector for coordinated multi-agent convergence ships shadow-first today, with fleet-scale validation pre-registered in the EDQS research program; (c) adaptive anomaly-detection thresholds that self-calibrate against ecosystem-wide behavioral distributions; and (d) formal verification of the authorization pipeline’s safety properties.

11.5 Scheme standing, liability, and standards posture

A DTP-evaluated transaction has no standing in scheme dispute rules today: a cardholder claim under Mastercard reason code 4837 proceeds exactly as if DTP did not exist, because liability shifts are creatures of scheme rulebooks—the property that made 3-D Secure economically meaningful—and no protocol can attach one to itself. The path matters more than the gap. Today, DTP outputs are advisory inputs to the issuer’s own authorization logic, with contracts allocating liability accordingly. Near term, every decision already emits a deterministic audit artifact—attested intent, fired gates, KYA score and zone at decision time, reason codes structured for DE 48.75 compatibility—so that when agent-initiated transactions acquire their own dispute reason codes, the canonical per-decision record stands ready as representment evidence; liability for agent transactions remains unwritten in scheme rulebooks as of this revision, so that evidence-standard position is open. Structurally, the position DTP targets is the one ACS and 3DS Server providers occupy in 3-D Secure: the issuer-side implementation and decisioning layer for whichever mandate and agent-identity standards the schemes ratify.

The interoperability posture follows: DTP consumes, and does not compete with, the network and platform mandate standards. Google’s AP2—whose governance moved to the FIDO Alliance—Visa’s Trusted Agent Protocol, Mastercard’s Agentic Tokens and Verifiable Intent, and x402 on crypto rails are intent-transport and identity primitives; DTP ingests them as strengthened inputs at the identity and intent gates and renders the issuer-side authorization decision none of them specify. Externally signed intent—Mastercard’s Verifiable Intent, or a human-signed AP2 Intent Mandate—is what lifts a machine step-up from a custody check to a runtime-integrity control (Sentinel Level B). The mandate format that wins is an input to DTP, not a competitor.

12. Conclusion

The emergence of autonomous AI agents as economic actors represents the most significant shift in payment infrastructure since the introduction of e-commerce. The Agent Trust Gap—the inability of human-centric authorization systems to verify machine identity, intent, and decision quality—poses a systemic risk to the $3–5 trillion agentic commerce market projected for 2030.

The Decision Trust Protocol addresses this gap through a layered, defense-in-depth architecture that provides continuous trust verification across four complementary dimensions: session integrity, cryptographic identity, deterministic authorization, and adaptive risk intelligence. The protocol’s Know Your Agent framework establishes a new paradigm for agent trust—one based on progressive verification, behavioral consistency, and decision quality rather than static credentials.

Critically, DTP achieves this without requiring modifications to existing card network infrastructure. By providing a reference mapping to Mastercard DE 48.75 data elements and operating as issuer-agnostic middleware, the protocol is designed for incremental adoption—issuers can integrate DTP alongside their existing authorization stacks, gaining agent trust capabilities without disrupting established processes.

As AI agents become ubiquitous participants in commerce, the question is not whether agent-specific authorization infrastructure will be built, but whether it will emerge as fragmented, issuer-specific implementations or as a shared protocol that enables interoperability and consistent trust standards. The Decision Trust Protocol is our contribution toward the latter outcome.

Changelog

This paper is the base document of Mandate Labs’ research program and is maintained as a living revision: the body always reflects the deployed system and the current evidence, and this section records what changed in each version, and why. Every numeric value in the body is verified against the deployed parameter registry at revision time.

v2.0 — August 2026. Corrections and post-publication evidence integrated into the body; the introduction deepened with the foundation the protocol rests on—what the infrastructure assumes about its human subject, why the agent inverts those assumptions and is structurally attackable, and the capability-invariant design stance for the machine-cognition era (§1.1–§1.3); the change record moved here. Why: as the base document, the paper should read current and clean, with its history at the end rather than stacked ahead of the abstract.

v1.2 — August 2026 (errata + addendum, now integrated). Trust-zone cutoffs corrected to the deployed 0.70 / 0.40 / 0.20 (v1.0: 0.75 / 0.50 / 0.25); KYA corrected to the deployed five-component composition 0.35 / 0.20 / 0.15 / 0.10 / 0.20 including per-decision intent quality (v1.0 and the v1.1 errata described the four-component 0.40 / 0.25 / 0.20 / 0.15 formula); trust-tier bases corrected to 0.00 / 0.30 / 0.65 / 0.90 (v1.0: 0.00 / 0.33 / 0.67 / 1.00); EDQS-B (live) separated from EDQS-Q (planned, in validation); APPROVE / DECLINE / STEP_UP made first-class, with machine step-up via the separately published Sentinel layer; rails restated as rail-agnostic, with card and crypto (x402/USDC) as the two live adapters (§3.1); 2026 red-team, benchmark, and incident evidence added (§2.5); scheme standing and standards posture updated (§11.5). Why: every value re-verified against the parameter registry at engine v0.6.0—drift between the published paper and the running system is a credibility defect—and the year’s external evidence bears directly on the protocol’s premises.

v1.1 — June 2026 (errata + addendum, now integrated). Pipeline count corrected to seven decision gates plus two system steps; Table 6 figures caveated as engine-internal test measurements; DE 48.75 language reduced to a compatibility statement, scheme certification neither held nor implied; scheme-rule standing stated plainly—no liability shift attaches to DTP, outputs are advisory; the consume-don’t-compete interoperability posture stated in writing; replay/idempotency enforcement and the confused-deputy case documented. Why: precision on scheme standing and on measured claims after external review.

v1.0 — May 2026. Original publication.