Know Your Customer, Know Your Agent, part 3: the mandate · October 9, 2026 · John Beckwith, Cooper Beckwith, LLC
In February 2016, $951 million of fraudulent payment instructions sent from Bangladesh Bank's own SWIFT terminal passed authentication, and $81 million was stolen. Authentication proves who holds the key. Authorization proves the holder had authority for this instruction, at this amount, to this payee, today. A customer's AI agent will present perfectly authenticated instructions, and the control that tells a legitimate one from a stolen or mistaken one is a record of what the customer authorized: the mandate.
This paper sets out what a mandate contains, scope, amount, window, counterparties, revocation, and evidence, and where the industry's new standards carry it, from Google's mandates and Mastercard's Verifiable Intent to Visa's signed headers and Singapore's runtime framework. It closes with the questions a director should ask about every instruction an agent brings to the window.
Free. Every new paper reaches subscribers first.