Skip to main content

​
ADR 0006: Bind autonomous execution to fine-grained mandates

This record defines the authorization object for internal rules and external agents.

​
Context

An OAuth scope alone cannot express an approved beneficiary, amount, frequency, lifetime, purpose, or caller. Concurrent execution must not exceed customer limits.

​
Decision

Require explicit beneficiary, currency, per-payment, total, count, daily, weekly, monthly, expiry, purpose, and caller constraints. Supply no monetary defaults. Reserve usage while holding a database lock, then submit through the financial-operation pipeline. Enforce the same or stricter limits locally and upstream. Fail closed when the two records disagree. Bind each external agent directly to its OAuth client ID. Store each internal rule as oauth-client-id:rule-id; require a trusted Auth0 internal_rule actor claim, that client ID, the mandates:execute scope, and the exact stored binding. A caller cannot assert a rule owned by another internal client.

​
Consequences

Customers approve a mandate once with step-up authentication. In-limit executions do not prompt again. Operator suspension is terminal; a customer creates a new mandate after review.

​
Rejected alternatives

  • OAuth scopes only: they grant an API family rather than a specific payment policy.
  • Local enforcement only in production: a wrapper defect or compromise could bypass customer intent.