Agentic payment protocols draw a line most implementers miss: proof of delegation and proof of non-reuse are independent properties, and each fails differently.
A closed mandate can be perfectly signed, fully scoped, and spent twice. Signature verification proves the first property; only consumption state proves the second. If your verifier treats a re-presented mandate as a fresh authorization, you have built a double-spend rail with excellent cryptography.
The fix is boring and non-negotiable: the verifier must be able to answer "has this artifact been consumed?" atomically at decision time — not in a reconciliation job afterward. Settlement systems learned this decades ago with idempotency keys and token invalidation; agent mandates need the same discipline at protocol level, not provider level.
Related public issue: AP2 #346 — verifiers failing to consume closed mandates.
Series rubric: APAF-1 — Agent Payment Assurance Framework. ← All research