What we told EMVCo about intent at the moment of execution.

On 6 September 2026 Decionis filed a public comment on EMVCo’s draft Agentic Payments — Framework for Specifications, twelve comments on the form EMVCo publishes for the purpose, acknowledged the same day as EMVCo query 20260906-BFF787. This note says what we asked for, why an implementer outside card rails is commenting at all, and where to read the filing as it was sent.

Decionis is not a member, subscriber or associate of EMVCo, and filing a public comment is not a partnership, a certification or an endorsement. The framework is EMVCo’s; the comment is ours, and whether any of it is taken up is EMVCo’s decision.

Where the draft already agrees with us

Three positions in the draft are ones we would defend. It separates identifying an agent from deciding anything about that agent’s transaction. It says what a constraint means without saying how it is enforced. And for a constraint type a verifier does not recognise, it says a security-critical verifier should treat the gap as a failure rather than skip it. Our comments extend those three choices to the moment of execution, which is where the draft currently stops.

What we asked for

Twelve rows on EMVCo’s feedback form, five of them marked as major technical comments. Clause numbers are the draft’s; each row on the form carries the justification and the proposed text, and the narrative companion carries the argument at length.

1. 01·Clause 4.3.5, 6.7.6·Technical, major

   Evaluate the final values at fulfilment time, against current state, and record the outcome as an artefact.

2. 02·Clause 5.4, 4.1, 6.9.2·Technical, major

   Give the draft's own reversion to immediate mode a named order state: held for the consumer, bounded, single-use, resolved only by fresh consent over the closed values.

3. 03·Clause 6.7.6, 5.5, 8·Technical, major

   When the state a stateful constraint needs is unavailable in autonomous mode, the fulfilment is not within bounds; record it as unevaluable and say so in the indicator.

4. 04·Clause 5.6, 5.1, 6.9.2, 6.7.3·Technical, major

   Define the minimum content and signing of the fulfilment artefact, and separate what a signature proves from what re-derivation proves.

5. 05·Clause 5.5, 4.3.3, 6.3.2, 6.7.6·Technical, major

   Make budget and recurrence consumption atomic and single-use, record the state position evaluated against, and keep that state out of the agent's hands.

6. 06·Clause 8·Technical, minor

   Reserve a reference to the fulfilment artefact in agentic transaction indicators, not only a flag that an agent was present.

7. 07·Clause 3, 5.2·Technical, minor

   State that Know Your Agent identifies an agent and never establishes that a specific fulfilment is within intent.

8. 08·Clause 1.2.2·General

   Scope out decision logic, not the shared semantics of outcomes and how they are recorded.

9. 09·Clause 2, 2.5·Technical, minor

   Name fulfilment evaluation as a responsibility, and one the agent never performs.

10. 10·Clause 6.10.1, 6.10.2·Technical, minor

    Move validation and execution out of the intent-service lane in two figures, so the figures match the role text.

11. 11·Clause 5.4, 5.5·Editorial

    An empty lifecycle bullet and a missing space.

12. 12·Clause 6, 5.9·General

    Say which body owns framework-required semantics inside the externally maintained credential mechanism, and define them independently of it.

Why an implementer outside card rails is commenting

Decionis evaluates a proposed action against the accountable organisation’s own policy before it commits, answers ALLOW, ESCALATE or BLOCK, and leaves a signed record a third party can verify without access to our systems. The draft’s hard cases — a budget consumed across several orders, a recurrence amended after it was authorised, an order that partly succeeds — are the cases where we have had to decide, in production, what “within bounds” means at the moment an action commits. That is the experience the comment is written from, and its limits are stated in the filing: we do not operate in card-network authorisation flows, and we claim no standing beyond that of anyone else who read the draft and wrote in.

Everything we assert about our own mechanism is public and checkable rather than asserted: the technical note that defines the gap the comment is about, a reproducible corpus of signed decision records (DOI 10.5281/zenodo.22312956), and an open verifier (@decionis/verify). A reader who wants to check the claims behind the comment can do so without an account and without trusting us.

Read the filing

• The completed EMVCo feedback form (PDF, 13 pages) — the twelve rows exactly as submitted.
• The narrative companion (PDF, 6 pages) — the positions, the reasoning behind each row, candidate framework text, and the questions we put to the working group.
• EMVCo’s specifications under public review — the draft itself is EMVCo’s document and is available from EMVCo, not from us.

What this filing is not

• Not membership, participation in a working group, or any relationship with EMVCo.
• Not a prediction. EMVCo records its observations on each comment; none had been returned when this note was published, and this page will say so when they are.
• Not a description of anything Decionis operates on card rails. The comment is offered from a mechanism that runs elsewhere, for whatever it is worth to the draft.