Imagine you give your teenager a debit card but tell the mall security guard to enforce the spending rules instead of the bank. The guard checks a list, maybe, but your bank — the one actually on the hook if the card is misused — never sees the rules until the charge lands. That is roughly how agentic AI payments work today: a credential provider outside the issuing bank mediates the transaction, and the bank only learns the details after the fact. This paper says: hand the clipboard back to the bank. The core claim is Issuer-Sovereign Agentic Payments, a method where the cardholder approves a spending rule once (e.g., "Agent X may pay Merchant Y up to $Z"), the issuing bank's own authentication component records it, and at payment time the bank checks the merchant against the rule before generating a card authentication value (CAV). If the merchant doesn't match, no CAV, no payment. The transaction then flows through standard card rails — Visa, Mastercard — with no new intermediary injected at execution time. Architecturally, this is a policy-enforcement relocation, not a new protocol. The paper sits in the family of token-scoping and delegated-authorization patterns that go back to OAuth scopes and EMV tokenization. The novelty is applying that pattern specifically to the agentic-AI payment context and arguing that the issuer, not a third-party credential provider, is the correct enforcement point because the issuer carries the financial risk. The mechanism is: rule registration → merchant-match at payment time → conditional CAV generation → normal card-network settlement. The ladder problem is severe. The paper names no competing system by version number, no benchmark, and no quantitative comparison. It references the general category of "current approaches" — presumably platforms like Stripe's agent toolkit or virtual-card providers — but does not measure latency, fraud rates, authorization success rates, or cost against any named baseline. We are told the method is better in principle; we are not shown it is better in practice. Integrity is the weakest dimension. There is no implementation, no simulation, no prototype, no user study, and no threat-model analysis with formal properties. The paper is a design proposal. That is legitimate as an early-stage contribution, but it means the validation is entirely argumentative — the authors assert the architecture is superior, and the reader must trust the reasoning. No code is released. No benchmarks are pre-registered because there are no benchmarks. The milestone question is interesting because the real bottleneck for agentic payments is not the authentication architecture — it is regulatory clarity (who is liable when an AI agent overspends?) and merchant-side adoption (do merchants need to change anything?). This paper implicitly assumes the existing card-network infrastructure is sufficient, which is plausible but untested. The next concrete proof point would be a pilot with an actual issuing bank processing real or simulated agentic transactions and measuring authorization latency, false-rejection rate, and fraud incidence versus the credential-provider baseline. The experiment not run is obvious: build it and test it. The authors describe a clean architectural diagram but do not implement it. The most charitable read is (a) — they are proposing the design for industry adoption and lack the banking-system access to prototype it. A less charitable read is that the design's simplicity is its weakness: the hard engineering is in the bank-side integration, merchant-rule matching at scale, and edge cases (partial matches, dynamic pricing, subscription merchants), none of which are addressed. This is a position paper wearing the clothes of a systems paper.
