Evidence-bound policy authorization for agentic commerce
Rohan Khanna, Hadrien Padilla, Noah Edmunds
Request the paperAbstract
AI shopping agents can approve a purchase under return terms the store never offered. A store lists several ways to return an item, each with its own fee, window and refund. An agent asked for a free return refunded to the card takes “free” from one option and “refunded to the card” from another, and says yes. We call this route mixing. We describe an authorization layer that keeps each route separate, marks every fact true, false or unknown with its source, and signs the decisions it allows, and we test it on real purchases.
The failure
Route mixing needs no bad intent. It is what a capable model does when a policy is read as one block of text: it finds a passage that satisfies each condition and stops. Every passage it found is real. The return it approved is not. Try it below.
1 · What the buyer needs
“Buy the boots, but only if the return is free, I’m refunded to my card and I have 30 days.”
2 · The store’s three return options
3 · Ask two agents
Same question, same store. Ask a typical agent and an agent using Blink.
Illustrative. store.example isn’t a real store.
The approach
Blink stores a policy as an evidence bundle: each return route listed on its own, and each fact on it marked true, false or unknown, with the store’s words beside it. A purchase is checked against one route at a time. The answer is one of three. ALLOW, when a single route meets every condition, with a signed receipt. DENY, when the policy rules the purchase out. REVIEW, when the evidence isn’t enough, with the missing fact named.
Before checkout, the receipt is checked against the purchase, the conditions, the evidence and the policy version. In our tests, every attempt to change one of them, or to reuse a receipt, was rejected.
What we found
We compared three ways of giving an agent a store’s policy, on real purchases from Canadian retailers, against answers checked by hand.
| Method | Cost | Speed | Across runs |
|---|---|---|---|
| Agent browses for itself | Highest | Slowest | Varies |
| Raw policy pages in the prompt | Low | Fast | Varies |
| Blink evidence, read once | Lowest | Fastest | Identical |
Keeping routes separate prevented route mixing in every controlled test, while a variant that merged routes approved purchases the buyer had ruled out. Pre-collected evidence made decisions far cheaper and faster than browsing, and identical across runs. No setup approved a purchase that should have been denied.
What didn’t work
Most of the saving came from not browsing; raw pages saved nearly as much. Our extractor applied item exclusions to whole pages, which cost accuracy. With hand-written evidence, the agent did as well as with the raw pages, but not better. And the order of our rules let an unknown fact block a decision another fact had already settled.
Limits
A small, apparel-weighted set of cases, tested with one model. “No unsafe approvals” describes these runs. It is not a safety guarantee.
What we’re fixing, in order
- Record facts per route, including confirmed free returns.
- Limit exclusions to the products they name, not the whole page.
- Reorder the rules so an established failure denies even when other facts are unknown.
- Check reliably that the list of routes is complete.
The evaluation artifact (corpus hashes, annotations, protocol and run logs) is available on request from hello@thankyoublink.com.