A card, boundto the mandate.
Every purchase is checked in real time against the same signed mandate that governs everything else an agent spends. In preview the authorizer records the decision it would make instead of enforcing it.
At a glance
Real infrastructure. A real authorizer.
CodeSpar built its own PCI-scoped cardholder data environment on AWS: a dedicated account, KMS envelope encryption and mTLS on both doors, and it is the only place a card number would ever live. The authorizer is separate. It runs on the platform, works on the issued-card identifier and the mandate, and never sees the card number.
Two outcomes of the same check
Illustrative examples. The mandate check and the authorizer's decision — approve or decline — happen in real time, on every attempted purchase.
One call, evaluated in real time.
Every attempted purchase calls codespar_card_authorize with the merchant, the amount and the agent's mandate ID. The authorizer checks the spend cap, the merchant category and the mandate's validity window the instant the charge is tried, then returns a decision your code can act on immediately.
const session = await codespar.sessions.create(); // The mandate is signed, not just configured — the authorizer verifies // the signature on every attempt, so a compromised session can't raise // its own spend cap. const attempt = await session.execute("codespar_card_authorize", { merchant: "SubscriptionCo", mcc: "5817", // digital goods / SaaS amount: 340.0, currency: "BRL", mandate: "cm_ops_4f2", }); console.log(attempt.decision); // "approve" | "decline" console.log(attempt.reason); // "within cap and merchant category" await session.execute("codespar_ledger", { record: "card_authorization", attempt, });
The same call runs whether the mandate authorizes R$3 or R$3,000 — the check doesn't change shape with the amount.
What this call chain does
- The authorizer verifies the mandate's signature on every attempt, not just its config
- A decision comes back in real time — approve or decline, with a reason
- Every attempt is recorded to the ledger, approved or not
Ad-hoc purchases end up on someone's personal card.
A subscription renewal. A travel booking. A one-off vendor charge — the purchases nobody scoped in advance always land on whichever card is closest at hand, and real oversight shows up three weeks later, when the statement arrives.
A subscription renewal, a travel booking, a one-off charge — it goes on whoever's personal card is closest at hand.
The agent holds its own card, scoped to its own signed mandate — never a shared personal or corporate number.
Approval happens when the statement lands, weeks after the charge already cleared.
The authorizer checks the merchant, the amount and the mandate's cap the instant the charge is attempted.
There's a record that a charge happened — rarely a record of why it was allowed.
Every attempt is logged against the mandate that governed it: the decision, and the reasoning behind it.
One shared card number means one leaked number, one mistake, exposes every agent using it.
Each mandate is scoped to a single agent. Compromise one mandate, and only that mandate is exposed.
From authorization to full settlement.
The mandate check and the real-time decision run today, in observe mode. Enforcement and full settlement are what come next.
- PCI-scoped cardholder data environment on AWS, called end to end over mTLS from the production platform
- Every attempted purchase evaluated against the mandate in real time, in observe mode: the decision is recorded, not enforced
- Every decision checked against the same signed mandate as any other spend
- Card issuing integrated with a partner in a staging environment, on test PANs
- Full settlement, as the authorizer moves from deciding to executing
R$0 in preview.
Free while Cards is in preview. At general availability, a governed card purchase settles on the same published rate as everything else — no separate per-card pricing.
PreviewPreview. The authorizer decides in real time and records it; it does not yet enforce.
Where this shows up
One real business case built around a card that only spends what its mandate allows.
Governed agent card
A card scoped to one agent's mandate, checked in real time against the same signed policy as every other spend, with the decision recorded.
See how →Cards, answered
Not yet — Cards is in preview. The authorization decision happens in real time; full settlement is what comes next.
Yes. A dedicated AWS account, KMS envelope encryption, mTLS on both doors, and the production platform has already called it end to end over mTLS. It is not a mockup. No real cardholder data has flowed through it yet: the issuer's card-number pull is gated on our attestation, so it runs on test PANs.
The same signed mandate that governs every other spend the agent makes, checked in real time by the authorizer.
We're integrated with a card issuing partner in a staging environment while the authorizer is in observe mode.
R$0 in preview. At GA, a card purchase settles on the same published rate as every other governed movement.
As we complete a soak against real traffic — this page updates the moment settlement goes live.
In observe mode, the authorizer computes that same decline decision in real time and logs the merchant, amount and reason — it just doesn't block the charge yet. That block is exactly what enforce mode adds.
A card network limit is checked against one shared card number, often after the fact. Cards checks a single agent's own signed mandate, on every attempt, the moment it's tried.
A card that only spends what the mandate allows.
Real infrastructure and a real decision on every attempt, recorded against the mandate that governed it.
cards: Preview. The authorizer decides in real time and records it; it does not yet enforce.