Capabilities

Merchant policy

The seller's half of the decision. Everything else here governs what a buyer may spend, and none of it says whether the seller wanted to sell.

Limits, mandates, the deny-first gate and a counterparty's published price all answer one question: may this buyer spend this. Whether the seller wanted to sell is a separate consent, and in practice it is the first decision a merchant makes about agent traffic. Hold a scarce or high-value line back for human buyers, sell the restockable lines to agents, require a recognised credential where it matters, and offer agent-specific terms where automation is worth something to the seller.

The card

A signed, machine-readable card. It states the seller's posture in plain language, what happens to an item no rule matches, the value above which a human is required, whether a recognised agent credential is needed, a floor on the evidence behind the agent's identity, and the named rules themselves.

Disposition: Per rule and for unlisted items: allow, deny, or requires_human, which maps onto the gate's confirm.
Match: A SKU rule is more specific than a category rule and wins. Ties go to the earliest rule.
Quantity ceiling: Units an agent may take of a scarce good, counted together with what it already took.
Agent terms: A different unit price or fulfilment window offered specifically to agents.
Rationale: Why the rule exists, in the seller's own words, inside the signed bytes.

There is no permissive fall-through. What happens to an unmatched item is a required field, so a card that simply forgot an item still states what it does with it.

A refusal carries the rule

Agent-specific terms are legitimate. Unexplained sorting is not. The card makes the difference structural rather than advisory: every rule carries a rationale, every set of agent terms carries a justification, and a card that omits either does not verify at all. Because verification comes first, a refusal always names a rule that exists in the signed card, and the agent can read exactly what it was refused by.

Every failing rule is reported, not the first one only, so an agent does not have to probe the seller one round trip at a time. Rule ids must be unique, so a cited refusal resolves to one rule.

What is evaluated

policy_card_verified: Deny. The card does not verify or is outside its window. An unreadable policy sells nothing.
policy_request_well_formed: Deny. The amount is not integer minor units, or the quantity is not a positive integer.
policy_item_offered_to_agents: Deny. The governing rule withholds this item from agents.
policy_human_required_for_item: Confirm. The governing rule sells it only with a human in the loop.
policy_agent_credential_recognized: Deny. A recognised agent credential is required and was not presented.
policy_identity_evidence_sufficient: Deny. The evidence behind the agent's identity is below the card's floor.
policy_within_quantity_limit: Deny. Requested plus prior units exceed the scarce-good ceiling.
policy_within_agent_value_ceiling: Confirm. Order value is above the card-wide ceiling.
policy_within_item_value_ceiling: Confirm. Order value is above the item's own ceiling.
policy_offer_price_met: Deny. Order value is below the published agent price for the quantity.

Two consents, and the merge only tightens

The buyer's decision and the seller's evaluation compose by taking the stricter outcome and concatenating the reasons and the checks. Neither side edits the other.

Composition

const seller   = evaluateAgainstPolicy(signedPolicy, request, { now, agent });
const decision = composeWithPolicy(gatewayDecision, seller); // stricter wins

The merchant side can turn an allow into a confirm or a deny. It can never turn a deny into an allow, and it can never authorise a payment the buyer's own mandate refuses. A merchant policy is therefore incapable of widening anything.

The honest boundary

A pure model. No store, no clock, no fetch: the instant, the agent identity and the quantity already taken are all injected arguments, so a verdict is deterministic and replayable. It resolves no identity and trusts no registry, so the agent side can come from a disclosure, a credential presentation or an identity graph without this knowing which. It holds no inventory and counts nothing. It does not price, negotiate or quote: the card publishes terms, it does not discover them. And it authorises nothing on its own.