AI agents can buy.
Make sure they buy only what was approved.

const reservation = requireAllowed(await verifier.verifyAuthority({
  envelope: purchase,
  evidence: signedAuthority
}))
const base = {
  compact: reservation.signed_receipt.compact,
  expected_envelope: purchase,
  expected_audience: processorAudience
}

const consumed = await processorGate.transitionExecutionAuthorization({
  ...base, action: "CONSUME",
  idempotency_key: `${attemptId}:consume`
})
if (consumed.transition_state !== "CONSUMED") stopPayment()

const outcome = await submitOnceToProvider()
if (outcome.status === "UNKNOWN") {
  await queueProviderReconciliation(outcome.reference)
  throw new Error("Provider outcome requires reconciliation")
}

await processorGate.transitionExecutionAuthorization({
  ...base,
  action: outcome.status === "COMMITTED" ? "COMMIT" : "RELEASE",
  idempotency_key: `${attemptId}:${outcome.status.toLowerCase()}`,
  processor_result: outcome.authenticatedAssertion
})