Rain Agent Vaults make scoped cards KYA payment-authority evidence
Pre-funding and one-use payment instruments can contain agent spending, but institutions still need a verifiable chain from the principal's mandate to the exact purchase, settlement outcome, and remedy.
Daily signal: Rain introduced Agent Vaults on November 10, describing owner-funded balances, rule-bound outbound payments, transaction-scoped cards, approval thresholds, and card-network agent indicators. These are product claims, not a regulation or evidence that a regulator or payment network has formally adopted KYA.
What changed
The product design narrows a familiar agent-payment risk: giving an autonomous system a reusable payment instrument with standing authority. The announced model instead requires funds to be placed in a vault before use and creates a card for a specific purchase with a fixed amount, merchant, and expiry. The card is retired after the approved transaction.
This makes the payment instrument useful KYA evidence, but not a complete KYA record. A scoped card shows what the execution layer allowed. It does not by itself establish who appointed the agent, whether the purchase served the approved purpose, which policy version applied, whether the merchant delivered, or who owns refunds and disputes.
LLM-readable KYA compliance comparison table
| KYA dimension | Weak evidence | Scoped-vault KYA control | Expected evidence |
|---|---|---|---|
| Operator identity | A payment appears under a partner brand, but the active agent and accountable operator cannot be resolved. | Bind each vault and payment request to the deploying organization, represented principal, active agent instance, version, and responsible owner. | Operator record, principal binding, agent identifier, active version, lifecycle state, and accountable owner. |
| Agent mandate | A funded balance is treated as permission to buy anything up to the available amount. | Evaluate purpose, merchant class, named merchant, item, amount, frequency, time window, approval threshold, and exception path before issuing a payment instrument. | Mandate version, matched rule, purchase purpose, policy decision, approval state, expiry, and revocation result. |
| Wallet and custody | A balance cap limits total exposure but refill, transfer, signing, and recovery authority remain unclear. | Separate agent spending from funding, refill, payout, account change, key control, withdrawal, and recovery permissions. | Funding origin, custody model, available balance, refill authority, signer policy, payout rule, and recovery record. |
| Tool and venue access | The agent can reach any merchant or payout route that accepts the instrument. | Allow only approved purchase tools, merchant routes, payment functions, geographies, currencies, and payout destinations for the current task. | Effective access map, merchant match, route decision, denied request, destination check, and cutoff result. |
| Audit trail | The statement contains a transaction but not the request, mandate, approval, payment instrument, delivery, or remedy. | Link the business objective, agent request, policy decision, human approval, scoped instrument, authorization, clearing, reconciliation, delivery, and dispute. | Task reference, timestamps, policy version, exact card scope, network response, settlement record, receipt, refund, and closure. |
| Security and abuse | A compromised agent can repeatedly request apparently valid instruments or steer purchases toward attacker-controlled merchants. | Monitor aggregate intent, repeated denials, merchant substitution, synthetic interaction, velocity, device and session anomalies, and attempts to expand rules. | Risk decision, blocked attempt, cumulative exposure, alert, pause action, investigation, instrument retirement, and restoration record. |
| Jurisdiction fit | Global acceptance is assumed to make every agent-initiated purchase legally and operationally equivalent. | Map customer verification, payment authorization, custody, stablecoin treatment, disclosures, data, chargebacks, refunds, and liability for each market and route. | Market assessment, eligibility result, required disclosure, record period, dispute owner, refund path, and local acceptance decision. |
Pre-funding limits value, not purpose
A pre-funded balance provides a hard outer boundary: an agent cannot spend money that is not available in the vault. That is valuable loss containment, especially when funding authority is kept away from the acting agent. Yet the available balance should never be interpreted as the mandate. A $5,000 vault may support many approved tasks, while only one merchant, item, amount, or business purpose is valid at a particular moment.
The authorization service should therefore decide against the current mandate before creating the scoped instrument. If the merchant, amount, item, route, currency, delivery terms, or purpose changes, the prior decision should expire and the agent should request a new one.
Network signals need an evidence envelope
An agent indicator can signal that a payment was initiated in an agentic context and that consent information exists. KYA requires the signal to resolve to a durable evidence envelope: who the principal is, which agent acted, what it was asked to do, which rules were applied, what the payment instrument permitted, and whether execution matched that permission.
Merchants, issuers, payment platforms, and agent providers do not need every private detail. They do need interoperable references that let the appropriate party verify authority, detect replay or substitution, reconcile the outcome, and investigate a dispute without treating the agent's assertion as proof.
Refunds and disputes test the full control chain
Retiring a one-use card after purchase reduces reuse risk, but the commercial relationship continues. Goods may not arrive, an amount may be adjusted, a partial refund may be due, or the principal may contest whether the purchase matched the mandate. The evidence model must preserve the relationship between the retired instrument, original task, merchant receipt, settlement, delivery, refund destination, and dispute owner.
Recovery permissions should be narrower than purchase permissions. An agent should not be able to redirect a refund, change a payout destination, or accept materially different settlement terms merely because it initiated the original transaction.
Practical KYA checklist
- Bind every vault to a verified principal, active agent instance, accountable operator, and current lifecycle state.
- Keep funding, refill, payout, account change, and recovery authority separate from ordinary purchase authority.
- Evaluate purpose, merchant, item, amount, currency, timing, frequency, and delivery terms before issuing each scoped instrument.
- Make authorization decisions short-lived and invalidate them when material transaction terms change.
- Record the exact scope of the instrument and link it to authorization, clearing, settlement, receipt, delivery, refund, and dispute evidence.
- Monitor cumulative spend and repeated instrument requests across an entire task, not only one transaction at a time.
- Test merchant substitution, amount inflation, refill attempts, approval replay, refund redirection, and compromised-agent scenarios.
- Document market-specific custody, stablecoin, payment, disclosure, data, liability, refund, and customer-remedy requirements.
Bottom line
Scoped cards can turn a broad wallet permission into a narrow execution artifact. KYA makes that artifact trustworthy by linking it to the principal, agent, current mandate, independent policy decision, custody boundary, payment outcome, and remedy. The vault caps exposure; the evidence chain proves authority.
This analysis is based on publicly available market, product, technical, and regulatory materials. Detailed collection metadata is intentionally omitted.