Decision token
A decision token is a verifying party's signed record that a specific agent action was allowed, denied or escalated before execution.
The decision records which action with which amount to which counterparty under which mandate was assessed. An allowed decision must lie within the mandate's scope; a denied one is valid evidence even if the action was outside – it proves the control worked. Synonym: decision evidence token.
Example
Before a payment, the agent asks a decision service. It checks the mandate and replies with a signed decision: allow, deny or escalate. Only on “allow” does the system execute the payment.
How it differs
A mandate applies in advance to many actions, a decision to exactly one. A receipt is created afterwards and records what actually happened.
In practice
- Run the decision service outside the agent. An agent that decides on its own authority offers no protection against mistakes or manipulation.
- Limit a decision's validity to minutes and bind it to exactly one action, so it cannot be reused for a different action.
- Define when to escalate, such as above an amount or for new counterparties, and record the person's approval as a signed record too.
Role in KYA
KYA verifies the decision's signature, issuer, agent and action as well as its reference to mandate and receipt. If the decision does not match the executed action, the execution binding reveals it.
Related check: Scope of the action (intent_scope). Is the action within the mandate's action type, amount limit, currency and counterparty?
Decisions before execution are produced, for example, by the reference implementation Mandact (from the operator of KYA); KYA checks whether decision and mandate match.
Frequently asked questions
What is a decision token?
A signed decision made before an action is executed: allow, deny or escalation to a person.
Why is a decision needed in addition to the mandate?
Because the mandate sets limits, while the decision records for one specific action that it was checked and allowed at that moment.
What does an escalation mean?
The decision service hands the action to a person, for example for a high amount. Execution follows only after that person approves.
Who creates the decision?
A decision service that knows the mandate and works independently of the agent. It signs its decision so it can be verified later.
How long is a decision valid?
As short as possible, usually only a few minutes. A decision applies to exactly one action; if it is not executed in time, a new decision is needed.