Proof of Intent Is Not Proof of Execution

Abstract

Agentic commerce is introducing a fundamental change to digital transactions: software agents are progressing from providing recommendations to independently initiating and coordinating economic activity on behalf of users.

This transition introduces a question that conventional authentication and payment authorization cannot resolve in isolation:

How can an independent party determine whether an agent's observed execution remained consistent with the authority originally granted to it?

Emerging frameworks from American Express, Mastercard and Visa address important aspects of this problem, including authenticated purchase intent, agent recognition, payment controls and trusted execution.

However, an authenticated authorization artifact is not necessarily evidence of every subsequent action undertaken by an agent or its delegates.

This paper examines that distinction and introduces independent execution provenance as a complementary assurance requirement.

1. Authorization and execution are different security properties

Traditional authorization establishes whether a principal is permitted to perform a particular action under specified conditions.

In agentic systems, authorization may be represented by signed instructions, delegated credentials, policy constraints or transaction-specific tokens.

Let an authorized intent be represented as:

I = (P, A, C, T, V)

Where:

• P: authorized principal
• A: permitted actions
• C: operational constraints
• T: temporal validity
• V: authorization version and revocation context

A valid authorization establishes an asserted permission relationship within a particular trust framework.

It does not establish that the agent's subsequent actions complied with that permission.

Let execution be represented by:

E = {e₁, e₂, …, eₙ}

where each eᵢ represents an observed or asserted execution event.

The central assurance question becomes:

Consistent(E, I)?

That evaluation cannot be completed reliably without sufficient, trustworthy evidence connecting the authorization to the relevant execution events.

2. Industry progress on verifiable intent

In March 2026, Mastercard introduced Verifiable Intent, addressing how agentic commerce can establish what a consumer approved.

Its Agent Pay Trust Framework further addresses identity, intent, controls, trusted execution and intelligence.

Visa's Trusted Agent Protocol introduces cryptographic mechanisms for merchants to recognize trusted agents and establish authorization-related context during commerce interactions.

In October 2026, American Express published Intent Intelligence, introducing a framework for capturing and authenticating customer purchase intent and making that authorization available to the issuer before the agent completes the purchase.

These frameworks represent substantial progress.

They should not be characterized as merely issuing identity tokens or lacking execution controls. Rather, they establish different mechanisms for verifying authorization, controlling transactions and managing trust within their supported boundaries.

The remaining architectural question concerns evidence continuity across independent systems.

3. The delegation problem

Consider a customer authorizing an agent to purchase equipment subject to a maximum transaction value.

The originating agent may subsequently:

1. Delegate product discovery to a specialized agent.
2. Request pricing from multiple merchant services.
3. Select an item through an orchestration service.
4. Invoke a checkout integration.
5. Initiate a payment through a separate provider.
6. Receive asynchronous confirmation of the resulting transaction.

Each system can produce a locally valid record.

Yet the existence of several individually authenticated events does not automatically establish that they belong to the same authorized workflow.

A complete evaluation requires determining whether there is a defensible relationship between the originating authorization, delegated authority, execution decisions and resulting economic outcome.

This problem becomes more complex when systems use different identity models, event formats, clocks, cryptographic trust roots and retention policies.

4. Evidence continuity

An independent assurance system should evaluate the relationships between events rather than assuming that matching identifiers establish causality.

A trace identifier, for example, provides a useful correlation mechanism. It does not inherently prove that a particular customer authorization caused a later payment.

Likewise, a successful payment authorization establishes a specific payment outcome. It does not necessarily demonstrate the correctness of all prior delegated decisions.

Execution provenance therefore requires multiple classes of evidence:

• Authenticated authorization and policy assertions.
• Observable agent and tool interactions.
• Delegation and principal relationships.
• Merchant and checkout state transitions.
• Payment and settlement-related outcomes.
• Revocation, expiry and changes to applicable constraints.

Evidence must retain its origin, integrity properties, observation boundary and verification status.

Where evidence is missing, assurance must express uncertainty rather than manufacture continuity.

5. Introducing the Agentic Provenance Protocol

INEVRI is developing the Agentic Provenance Protocol (APP) as an independent provenance and assurance layer for agentic systems.

Its intended function is not to replace payment-network authorization, agent identity infrastructure or existing execution controls.

APP is designed to observe relevant activity at available integration boundaries, correlate independently sourced evidence and evaluate whether observed execution is consistent with asserted authorization.

The conceptual sequence is:

Authorization → Delegation → Execution → State Transition → Outcome → Evidence Evaluation

APP's architectural approach emphasizes non-invasive integration, source-aware evidence correlation and explicit verification states.

It is designed to distinguish between outcomes supported by sufficient evidence, contradictions established by available evidence and cases that cannot be resolved.

Independence refers to the separation of the evaluator from the systems generating the underlying claims. It does not guarantee complete observational access or eliminate dependencies on evidence providers.

6. Trust must extend beyond a valid token

Cryptographic authorization is essential infrastructure for agentic commerce.

But the increasing autonomy of software agents creates a broader assurance requirement: the ability to reconstruct and evaluate the observed relationship between permitted actions and actual system outcomes.

The relevant question is no longer exclusively whether an agent was authorized.

It is whether the available evidence supports the conclusion that the agent and its delegates acted consistently with that authorization.

Proof of Intent establishes permission. Execution provenance establishes what can be evidenced about subsequent behaviour.

The Agentic Provenance Protocol is being developed to address the independent, cross-boundary dimension of that problem.

References

1. American Express — Intent Intelligence Framework (opens in a new tab), October 13, 2026.
2. Mastercard — Verifiable Intent (opens in a new tab), March 5, 2026.
3. Mastercard — Trust in Agentic Commerce (opens in a new tab), September 30, 2026.
4. Visa — Trusted Agent Protocol Specifications (opens in a new tab).

---

INEVRI | Independent provenance infrastructure for the agentic economy

This publication describes an architectural thesis and developing technical approach. It does not imply endorsement, certification, interoperability approval or commercial affiliation with the organizations referenced.