Every payment-authority claim, classified and traceable.

METHODOLOGY

How a row earns its classification

Deterministic means a normalized fact, cryptographic binding or durable state transition has a reproducible fail-closed outcome. Advisory means a contextual or heuristic signal may require REVIEW but cannot create authority. External means the control is a required customer integration responsibility outside the boundary MandateShield can enforce.

A conformance vector is cited only when its current canonical ID directly exercises the stated behavior. An empty vector list means the claim is derived from the published product contract, not that a portable test result has been invented. This matrix was reviewed on July 26, 2026.

DETERMINISTIC · BLOCK

Registered mandate authority

Strict v2 withholds an executable reservation when no matching active registered mandate exists.

Evidence basis: The production invariant and public API contract require an active mandate version before authority can be established.

Machine identifiers

• Reason codes: REGISTERED_MANDATE_REQUIRED
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• The customer remains responsible for obtaining lawful user authority and registering the correct mandate.
• Registration does not establish payment credential validity or settlement.

DETERMINISTIC · BLOCK

Exact fiat amount representation

Malformed, non-representable or conflicting fiat amounts fail closed before an execution reservation can be created.

Evidence basis: Executable offline vectors exercise valid USD cents, contradictory representations and a fractional zero-decimal currency.

Machine identifiers

• Reason codes: INVALID_AMOUNT, AMOUNT_PRECISION_INVALID
• Conformance vectors: fiat-usd-exact-minor-units, fiat-conflicting-minor-units, fiat-jpy-fractional-major-unit

Limits

• Currency exponent handling does not perform foreign-exchange conversion.
• Taxes, fees and shipping must already be reflected in the normalized final amount.

DETERMINISTIC · BLOCK

Fiat amount, currency and merchant scope

A missing ceiling or scope, overspend, currency switch or merchant substitution blocks the request.

Evidence basis: These are deterministic policy branches in the published reason-code and execution-boundary contracts.

Machine identifiers

• Reason codes: MISSING_SPEND_CAP, SPEND_CAP_EXCEEDED, NO_CURRENCY_SCOPE, CURRENCY_OUT_OF_SCOPE, NO_MERCHANT_SCOPE, MERCHANT_OUT_OF_SCOPE
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• Merchant identifiers must be normalized consistently by the integrator.
• This control does not verify merchant solvency, sanctions status or fulfillment.

DETERMINISTIC · BLOCK

Exact atomic-asset scope

One unit above the cap or a substituted asset, network, exponent or resource fails closed.

Evidence basis: Executable vectors distinguish adjacent integers beyond JavaScript Number precision and reject resource substitution.

Machine identifiers

• Reason codes: INVALID_ATOMIC_AMOUNT, MISSING_ATOMIC_SPEND_CAP, ATOMIC_DECIMALS_MISMATCH, ATOMIC_SPEND_CAP_EXCEEDED, ASSET_OUT_OF_SCOPE, NETWORK_OUT_OF_SCOPE, RESOURCE_OUT_OF_SCOPE
• Conformance vectors: x402-exact-beyond-safe-integer, x402-one-unit-over-cap, x402-resource-substitution

Limits

• The hosted bridge only parses selected x402 v2 PAYMENT-REQUIRED fields and never constructs or verifies PAYMENT-SIGNATURE.
• The optional first-party customer-side exact/EIP-3009 Gate creates one payload through the customer's compatible client, verifies its signer locally and reconciles customer-supplied canonical chain evidence; it is not a facilitator or hosted settlement service.
• The integration must supply a trusted merchant identity and asset decimals; asset and resource context values cannot override the selected offer.

DETERMINISTIC · BLOCK

Consent and authority expiry

Missing consent, missing expiry or expired authority blocks; an overly long analysis window can produce REVIEW.

Evidence basis: Consent and expiry are explicit branches in the public decision contract; production signed evidence also requires freshness.

Machine identifiers

• Reason codes: MISSING_EXPIRY, MANDATE_EXPIRED, CONSENT_NOT_PROVEN, LONG_EXPIRY_WINDOW
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• The verifier checks recorded facts, not the quality of a user-interface consent flow.
• Consumer-law disclosure and revocation processes remain the operator's responsibility.

DETERMINISTIC · BLOCK

Signature and account-pinned key trust

Invalid signatures, unsafe keys, caller-selected trust or registered issuer/audience mismatches cannot establish execution authority.

Evidence basis: The strict execution invariant requires ACCOUNT_PINNED key trust in addition to valid supported signatures.

Machine identifiers

• Reason codes: CRYPTOGRAPHIC_SIGNATURE_INVALID, CRYPTOGRAPHIC_KEY_UNSAFE, UNTRUSTED_VERIFICATION_KEY, TRUSTED_ISSUER_MISMATCH, TRUSTED_AUDIENCE_MISMATCH
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• The account operator is responsible for onboarding and rotating the correct issuer key.
• The wider protocol trust registry is not replaced by a local key pin.

DETERMINISTIC · BLOCK

Signed final-purchase binding

Changing the merchant or another bound purchase fact after signing rejects the evidence.

Evidence basis: The cryptographic integration vector preserves a valid JWS while substituting the evaluated merchant and expects rejection.

Machine identifiers

• Reason codes: SIGNED_INPUT_BINDING_MISSING, SIGNED_INPUT_BINDING_MISMATCH, TAP_CONTENT_DIGEST_MISMATCH
• Conformance vectors: jws-final-envelope-substitution

Limits

• Only facts included in the normalized envelope can be bound.
• The integrator must ensure the envelope represents the final checkout rather than an earlier draft.

DETERMINISTIC · BLOCK

One-time challenge and signed freshness

Missing, expired, future-dated or mismatched nonce and freshness evidence fails closed.

Evidence basis: Challenge consumption and bounded signed freshness are normative strict-v2 requirements.

Machine identifiers

• Reason codes: CRYPTOGRAPHIC_EVIDENCE_EXPIRED, CRYPTOGRAPHIC_EVIDENCE_NOT_YET_VALID, CRYPTOGRAPHIC_EVIDENCE_FUTURE_IAT, PRODUCTION_EVIDENCE_FRESHNESS_REQUIRED, CRYPTOGRAPHIC_NONCE_MISMATCH, VERIFICATION_CHALLENGE_INVALID
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• Clock synchronization and correct challenge handling remain integration dependencies.
• Fresh evidence does not by itself prove lawful authority.

DETERMINISTIC · BLOCK

AP2 and TAP evidence-profile checks

Missing AP2 holder proof or omitted TAP signed components rejects the evidence.

Evidence basis: Portable cryptographic integration vectors cover AP2 holder binding and TAP required signed components.

Machine identifiers

• Reason codes: SD_JWT_KEY_BINDING_REQUIRED, AP2_PAYMENT_AMOUNT_MISMATCH, AP2_PAYEE_MISMATCH, AP2_TRANSACTION_BINDING_MISMATCH, TAP_REQUIRED_COMPONENT_NOT_SIGNED, TAP_AUTHORITY_MISMATCH, TAP_SIGNATURE_INVALID
• Conformance vectors: ap2-holder-proof-required, tap-required-component-omitted

Limits

• Full AP2 checkout/delegate-chain and issuer-registry processing remains external.
• Raw Visa structured-field and Visa trust-store processing remains external.

DETERMINISTIC · BLOCK

Account-wide replay and persistence

Exact retries recover the committed result; conflicting or concurrent reuse fails closed.

Evidence basis: One executable offline vector rejects an unsafe key; one stateful contract vector specifies account-wide recovery and conflicting reuse.

Machine identifiers

• Reason codes: REPLAY_GUARD_MISSING, REPLAY_GUARD_INVALID, REPLAY_DETECTED, CONCURRENT_REPLAY_DETECTED, REPLAY_RECORD_UNAVAILABLE, PERSISTENCE_UNAVAILABLE
• Conformance vectors: replay-key-invalid-characters, strict-account-wide-replay-recovery

Limits

• The stateful vector is an integration target, not an independent deployment attestation.
• A customer gateway must use stable identifiers consistently across its own retries.

DETERMINISTIC · BLOCK

Cumulative budget and execution state

Only a live, persisted, account-pinned ALLOW can create RESERVED state; PROCESSOR credentials alone may CONSUME, COMMIT or RELEASE it.

Evidence basis: The public standard defines the eight-field execution invariant, role-separated credentials and legal state transitions.

Machine identifiers

• Reason codes: EXECUTION_AUTHORITY_NOT_ESTABLISHED
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• The hosted verification service does not require payment credentials; customers must not submit them, and the service does not submit or settle payments.
• Optional first-party Gate adapters run inside customer infrastructure, where they may validate payment credentials, submit one bound provider attempt and reconcile its outcome.
• A gateway that bypasses the required CONSUME transition is outside the enforceable boundary.
• A processor_result is an authenticated customer-adapter assertion, not provider-signed settlement proof.

DETERMINISTIC · BLOCK

Provider outcome reconciliation independent of caller assertion

The hosted worker binds one ProviderSubmission to its claimed permit, checks the exact Stripe PaymentIntent or x402 transaction without trusting the caller report and only then autonomously COMMITs or RELEASEs. Pending, unknown, mismatched and conflicting evidence remains fail-closed.

Evidence basis: The public OpenAPI, ProviderSubmission, ProviderEvidence, ReconciliationRecord and execution-receipt contracts define durable lease recovery, strong evidence classes and exact independent_verification semantics.

Machine identifiers

• Reason codes: No dedicated reason code is claimed for this row.
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• Stripe verification requires an account-configured restricted lookup key and exact connected-account binding.
• x402 verification requires a configured EVM RPC endpoint and confirmation policy; RPC availability is not guaranteed.
• A provider API or chain lookup proves only the exact recorded provider outcome, not external provider adoption of MandateShield permits.
• No independent security audit or external certification is claimed.

DETERMINISTIC · BLOCK

Signed receipt consistency

A changed decision core or contradictory top-level decision is rejected even when other receipt fields are self-consistent.

Evidence basis: Portable receipt-integration vectors specify the two negative verification outcomes.

Machine identifiers

• Reason codes: No dedicated reason code is claimed for this row.
• Conformance vectors: receipt-decision-core-digest-tamper, receipt-top-level-decision-contradiction

Limits

• Passing a receipt verifier proves receipt consistency, not payment settlement.
• The published profile is vendor-authored and is not independent certification.

DETERMINISTIC · BLOCK

Unknown strict constraint handling

An unsupported strict constraint blocks instead of being silently ignored.

Evidence basis: An executable offline vector adds an unsupported allowed_items constraint and expects BLOCK.

Machine identifiers

• Reason codes: UNSUPPORTED_CONSTRAINT_FIELD
• Conformance vectors: strict-unknown-constraint-field

Limits

• Integrators must adopt an explicit versioned adapter before relying on a new constraint.

ADVISORY · REVIEW

Prompt-injection pattern signal

The signal can require REVIEW; deterministic authority checks remain decisive.

Evidence basis: The public methodology and security architecture explicitly classify this control as heuristic.

Machine identifiers

• Reason codes: PROMPT_INJECTION_SIGNAL
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• Pattern detection can produce false positives and false negatives.
• It is not a complete prompt-injection detector and never creates authority.

ADVISORY · REVIEW

Privacy-thresholded community signal

A qualifying signal can require REVIEW but does not create an automatic community block.

Evidence basis: The public methodology identifies cross-account observations as contextual rather than deterministic authority.

Machine identifiers

• Reason codes: COMMUNITY_THREAT_SIGNAL
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• Absence of a signal does not establish safety.
• The signal is not sanctions screening, fraud scoring or an identity registry.

EXTERNAL · EXTERNAL

Processor-gateway enforcement

MandateShield exposes role-separated state transitions but cannot prevent an external merchant system from bypassing them.

Evidence basis: The standard and methodology define this as a mandatory integration responsibility outside the hosted verification boundary.

Machine identifiers

• Reason codes: No dedicated reason code is claimed for this row.
• Conformance vectors: No directly corresponding portable vector is claimed.

Limits

• No payment is submitted, processed or settled by MandateShield.
• Correct gateway wiring requires customer-side implementation and testing.

GLOBAL LIMITATIONS

What this matrix does not establish

• It does not establish an independent audit, accredited certification or correct customer deployment.
• The hosted authority-verification route does not require payment credentials, customers must not submit them, and it does not submit or settle payments.
• Optional first-party Gate adapters run inside customer infrastructure, where they may validate payment credentials, submit one bound provider attempt and report its outcome.
• Narrow hosted reconciliation may independently observe a configured Stripe PaymentIntent or x402 canonical-chain outcome after submission. It does not hold the payment credential or submit the operation.
• Caller reports and signed Stripe webhooks remain CALLER_ASSERTED hints. Only an independent exact provider API or finalized-chain check can create stronger evidence and autonomously finalize; unresolved or conflicting results remain fail-closed.
• MandateShield does not screen sanctions or provide fraud insurance.
• An authorization result does not prove every aspect of a transaction is legitimate.
• Customer gateway enforcement, provider submission and settlement remain external. Hosted reconciliation only observes the narrow supported outcome after submission and does not establish that a provider adopted or enforced the permit contract.

PRIMARY SOURCES

Contracts and official specifications

First-party MandateShield contracts define shipped behavior. External protocol statements link to their primary official publishers. Accessing an external specification may be subject to its publisher's terms.