TECHNICAL NOTE · PROPOSED INTEROPERABILITY · 9 NOV 2026
A valid signature does not always mean legitimate authority.
AP2 and OAuth carry mandates and delegation. PAVREN links operational capability to the person entitled to authorize the action.
01
Four layers, different questions
- 01 · Legitimate authorityWho has the right to authorize and under which grant?Govern · authority source and Authorized Envelope
- 02 · Operational mandateWhich signature, token and limits are transported?AP2 v0.2 · OAuth / RFC 9396 (proposed extension)
- 03 · Point of actionMay this particular action take effect now?C19 / PEP / AuthZEN · decision and reason
- 04 · EvidenceWho proposed, who approved and what was recorded?Signed mandate, approval, dossier and trace
02
Ana scenario: supplier payment
Ana has a hypothetical USD 5,000 authority limit. She requests an USD 18,000 supplier payment. Test scenarios without executing any payment.
USD 5,000.00 → Ana · USD 18,000.00 → Finance Manager. No actual payment or authorization. The browser does not verify grants or signatures.
No actual payment or authorization. The browser does not verify grants or signatures.
Hypothetical outcome
ESCALATE
Signature and mandate
Institutional competence
May it execute?
Evidence
03
Key field relationships
| What to verify | AP2 / OAuth | PAVREN contribution |
|---|---|---|
| Current actor | OAuth sub / act.sub and cnf.jkt key | Identity and delegation chain tied to envelope |
| Payment scope | Checkout/Payment Mandates and limits; optional authorization_details | Legitimate grant, intended payee and institutional cap |
| When to stop | A valid token or mandate does not imply current authority | C19 check, revocation and material action |
| Evidence | AP2 mandates and receipts | Decision, approver, authority source and linked evidence |
Illustrative only, without actual signatures or registered identifiers. These examples are not production API contracts.
04
Six controls for a real integration
- Escalation flooding: collapse and rate-limit approval requests to reduce fatigue.
- Amount conversion: compare exact minor units and ISO 4217 precision, not floating point.
- Actor laundering: validate chain and competence at relevant boundaries.
- Revocation lag: check current envelope state at the point of material effect.
- Blind signing: display competence, amount and payee before approval.
- Unenforced paths: close alternate connectors that can cause material effects.
05
Full original paper
Original full text, tables and diagram preserved.
C10 · C19 · PRF-PERS · Annex P · Annex I · Annex S
Supplementary proposed technical note; does not replace Govern 3.0 or demonstrate deployed protocol interoperability.
Supplementary proposed technical note; does not replace Govern 3.0 or demonstrate deployed protocol interoperability.
Back to a guided developer case, or read the original control C19 in full.
From protocol to a real adoption path
Before connecting systems, understand the same authorization issue without code or explore implementation options.
Understand the everyday case → · Optional integration support →