Agreed, and that's exactly the split I'd argue for. The limits that matter most (per-payee cap, short expiry, known payee) belong in the signer, where no amount of persuasive invoice text can move them. The model only gets a vote on what's left over.

Your invoice example is the real failure mode. In my own tests, every unsafe approval my model made was a prompt injection: text in the request talking it into a payment. The deterministic checks held all of them. That's the whole reason the rules sit in front of the model, not behind it.

And good point on AP2. A mandate proves who authorized a purchase, not that the agent understood the request. Those are two separate checks, and you need both.

Since you'd be the one signing: want to try breaking it? There's a live demo linked under "Try it" at the end of the post, no signup needed. Give it a payment request with an invoice that lies about the amount and see whether it holds. I'd genuinely like to know what gets through.