--- title: "Canceling the Card Doesn't Stop the Charges" date: "2026-06-05T13:00:00-07:00" lastmod: "2026-06-05T13:00:00-07:00" description: "You canceled the card, and the gym billed the replacement number you never gave it. Endings are the hardest part of delegated authority, and payments has the scars to prove it: freezes versus cancellations, charges caught between authorized and settled, disputes as governed undo, and the statement that joins the whole story. AI agents need every one of those endings, built on purpose." summary: "Cancel a card and watch what refuses to end: the subscription bills the new number the network helpfully forwarded, the pending hotel charge settles days later, and the refund arrives through a process you do not control. Payments learned that ending an instrument is not ending an arrangement, and built machinery for the difference: reversible freezes, terminal cancellations, single-use cards that retire themselves, in-flight states between authorized and settled, chargebacks as governed compensation, and the statement that reconciles everything to one project code. This post maps each ending onto the agent task that must actually stop, and closes with the breaks, including the one where the analogy runs backward." slug: "canceling-the-card-doesnt-stop-the-charges" tags: - "Agentic Identity" - "Delegated Authority" - "IAM" - "Authorization" - "Security Architecture" series: - "what-the-corporate-card-already-solved" --- You cancel a card. The issuer confirms. The plastic is dead. Next month the gym bills you anyway, on the replacement card's number, which you never gave it. Nothing malfunctioned. The network's account updater service forwarded your new number to merchants that bill you on file, because continuity of billing is a feature that took real engineering, and it worked perfectly. You ended the instrument. The *arrangement* sailed on, because no part of the system recorded that the arrangement itself was supposed to end. > Ending the credential is not ending the arrangement. Notice the causality in a governed program. The reason ends first, and the credential dies *because* the reason did: the trip is cancelled, so the card freezes. In most agent systems the causality is missing entirely. The reason ends and nothing notices, because nothing recorded that the credential existed for a reason at all. Every hard truth about ending delegated authority is in that gym charge. Credentials are easy to kill. The work they were feeding is not, because the work has its own momentum: standing arrangements, charges in flight, helpers mid-task, and systems that were built, carefully and correctly, to keep things running. Payments has spent decades building machinery for endings anyway. This post walks that machinery, because AI agents need every piece of it, and mostly have none. # Endings Come in Kinds The card world refuses to treat "make it stop" as one operation, and the distinctions all carry. **The freeze is a pause.** Something looks wrong, so you freeze the card from the app. Every authorization declines, instantly, but nothing is torn down. Unfreeze and life resumes. The freeze exists because the most common emergency is uncertainty, and uncertainty needs a reversible answer. A system whose only stop is destruction teaches its operators to hesitate. **The cancellation is terminal.** The card is dead, forever, and everything that depended on it must be re-established deliberately or not at all. **The expiry is a clock.** Cards die on schedule whether or not anyone remembers them, the backstop for every arrangement that outlived its attention. **And completion is the ending standing cards do badly.** The trip ends, the project closes, and the card simply continues, still valid, still standing authority, until an expiry or an audit catches it. Standing instruments that outlive their purpose are the expense world's chronic disease, and its cure is the single-use virtual card: an instrument bound to one purchase that retires *itself* the moment the purchase completes. The authority ends because the work did, with no one lifting a finger. The modern spend programs have already made that the default, and it is the right default for agents too: authority that expires with the task, not with the calendar. One more rule hides in the limit increase. When you genuinely need more, an issuer can raise your limit in place, and a well-run corporate program deliberately resists making that the default. It issues a new instrument for the new need, freshly approved and freshly scoped, because an instrument whose bounds drift upward in place slowly stops meaning anything. What was approved should stay what is in force, and growth should have a paper trail of its own. # Authorized Is Not Settled Cancel a card mid-month and look closely at the statement. Some charges are finished. Some are *pending*, authorized days ago, settling now. One is a hotel hold that will simply evaporate. The card world runs on the distinction between a transaction that was approved and a transaction that actually happened, and every ending has to reckon with the space between them. That space is a taxonomy, and it transfers whole. When the task stops, its work in flight is in one of four states. Not yet submitted, so kill it. Authorized but not executed, so release it. Executed, so it is real and no cancellation reaches it. And the ugly one: *unknown*, submitted somewhere and unconfirmed, which honest systems route to a human instead of guessing. Payments never pretends an in-flight charge is simply gone because the card died. Agent systems that treat task termination as a boolean are pretending exactly that, and the pretending shows up later, in the audit. **And un-spending is governed.** When a charge must actually come back, you do not reach into the merchant's account and take it. You *dispute* it: a process with evidence requirements, deadlines, categories, and an adjudicator. The undo is itself a controlled operation, because an undo is money moving, and money moving is exactly the thing the whole system governs. The agent parallel is sharp. Compensating a half-finished task, the reversing entry, the retraction email, the rollback, is itself consequential work, and a terminated task must not become a back door for ungoverned "cleanup." If the undo is not governed, the attacker's easiest move is to get something canceled. # The Statement Joins Everything At the end of the month one document reconciles the whole story. The statement pulls every authorization, settlement, credit, and dispute, and on a corporate program every line carries the project code, so an auditor pulls one thread and the entire arrangement unspools: the request, the approval, the cards issued, every transaction each one made, the freeze, the disputes, the final balance. Notice what makes that possible. It is not diligence. It is that every event, from the first approval to the last chargeback, was stamped with the same identifier at the moment it happened. Nobody reconstructs the trip from timestamps and vibes. The join key was built in. Agent systems that plan to assemble the story later, from logs scattered across every system the agent touched, are planning an archaeology project. The statement works because the story was joined as it was written. # Where the Analogy Breaks **The big one runs backward.** Everywhere else in this series, the card world is ahead and agents need to catch up. Here the analogy inverts. Card freezes work quickly *because online card authorizations consult issuer-controlled state*, one state change, checked at the accepting edge. Agent credentials are built to work offline, verified locally, on purpose, for speed, which means there is no equivalent switch. Ending an agent task means building the machinery the card world got for free: a place where the task's state lives, and consumers that actually check it, fast enough to matter. Anyone who assumes revocation just works, the way a card freeze just works, has imported the analogy's easiest property into the one place it does not apply. **Even the network leaks on purpose.** The gym charge was not a bug. Account updating and merchant-initiated billing are continuity features, built because most cancellations are card replacements, not relationship endings, and continuity is usually what the customer wants. The lesson generalizes: every mature system grows features whose whole job is to keep things running, and those features cannot tell a routine ending from a revocation unless something records the difference. The agent version is the harness that helpfully resumes a suspended workflow, the retry queue, the cached connection, each one a little account updater, faithfully continuing an arrangement whose reason is gone. Continuity machinery must be taught to check whether the arrangement still stands, or it will defeat every ending you build. **You trust the issuer's statement.** The whole reconciliation story rests on one institution's ledger, and you accept it because the issuer and card program sit inside a regulated, audited operating model. Agent tasks cross companies and clouds that share no such institution. There is no issuer whose statement everyone accepts, which means the agent world's statement has to earn trust structurally, evidence that can be verified rather than vouched for. That is a genuinely new build, with no expense-world part number. The build list from this room: an ending someone can check, continuity machinery that checks it, and a record that earns trust without a bank behind it. # The Arc, Closed One loop, five posts. The card bound the instrument to an approved purpose. The approval bound what was shown. The contractor's card narrowed authority without borrowing it. The network made every use a fresh decision. And the ending, the hardest part, turned out to be a system of its own: pauses, terminations, self-retiring instruments, in-flight states, governed undo, and a statement that joins the whole story to one code. None of it is exotic. It is what a competent finance organization does by default, for money, because the alternative is negligence with a paper trail. Agents exercise authority that is broader than money, faster than any traveler, and easier to fool than any cardholder. The failure mode is not autonomy. It is the blank check. The bar the expense world sets is the *floor*. The protocol work is the translation. The loop itself needs no standard. You can start running it today.