Echoes
Echoes
The Load-Bearing Word
In June 2000, Congress gave machine-formed contracts federal standing, with one condition attached: the agent's action has to be "legally attributable to the person to be bound." What that means, the statute declines to say. For twenty-five years nothing forced the issue. When software executes precisely what somebody specified, attribution and authorship are one fact wearing two names. Agents that infer, substitute, and decide pry the two apart. The word is being asked to hold the weight by itself now, and the disputes that will settle its meaning are being generated in production, this quarter, by organizations that have no idea they are supplying the facts.
The Load-Bearing Word
In June 2000, Congress gave machine-formed contracts federal standing, with one condition attached: the agent's action has to be "legally attributable to the person to be bound." What that means, the statute declines to say. For twenty-five years nothing forced the issue. When software executes precisely what somebody specified, attribution and authorship are one fact wearing two names. Agents that infer, substitute, and decide pry the two apart. The word is being asked to hold the weight by itself now, and the disputes that will settle its meaning are being generated in production, this quarter, by organizations that have no idea they are supplying the facts.
The Unresolved Middle
Visa's safeguards for agent-driven shopping, as AP described them in June, read like a decent control plane: spending caps, approved merchants, required approval steps, fraud monitoring, a human watching closely at first. Each of those draws a line the agent can't cross. What none of them does is tell you whether the thing that happened inside the lines was any good.
The case that nags at me is the one Goodwin's lawyers use. An agent books a flight inside every constraint it was given — right route, under budget, approved seller — with a one-hour connection that requires clearing customs and rechecking bags. Card valid, instruction satisfied, merchant processed cleanly. Ticket's useless.
Then try disputing it. Visa's rules added agentic-transaction requirements in April, and they hold the cardholder responsible as though they'd bought it themselves. Denials of card-absent purchases still route through the dispute condition they always have. Nothing in the published evidence categories asks was this what you meant? Nobody ever needed it to. Somebody typed the card number.
Which is every control system I've ever run. It answers the questions someone thought to ask in advance, and the failures that cost real money turn up somewhere else.
A Professional Skeptic of Signatures on Delegation, Defects, and Who Loses the House
CONTINUE READINGSignal and Absence
Two Letters, and Suddenly It Was Your Problem
A bill comes in from Hamburg. Nobody in the counting house has ever seen the hand that signed it, and the sealed power of attorney is sitting in a drawer three hundred miles away. Then two letters beside the signature, p.p., changing nothing about whether the paper was good and everything about what the reader now owed himself. Free to write. Expensive to ignore. And critically, it rode on the instrument instead of living in the archive. In 1827 some London bankers ignored it for £1,560.
The Signature Has an Expiry. The Mandate Has No Field.
A signed agent request will tell you which key signed it, when, and when that signature stops counting. It will not tell you the errand: no spending ceiling, no prohibition, nothing about whether the authority gets handed down to software you'll never see. The signature has an expiry field. The mandate doesn't have a field at all. Thirty-two competing IETF drafts say the absence is felt. Not one of them agrees on where a limit should be written.
Further Threads
Past Articles
Visa and Cloudflare, solving different problems in different industries, independently arrived at the same structural mo...
For decades, enterprise workflow systems painstakingly rebuilt institutional process in software: approval chains, role ...
A U.S. military pocket purchase order once had four color-coded carbon copies. White went to finance. Blue went to the v...
A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the inten...