The cleanest refusal is the one that happens before the signer exists.
Most payment stories start too late. They begin with a failed request, a rejected settlement, a wallet error, a console line with just enough shape to make the caller think the system protected them. Sometimes it did. Sometimes it only failed after the dangerous part had already been invited into the room.
The safer boundary is earlier and less dramatic. Read the challenge. Name the recipient. Check the network. Check the asset. Check the amount. Check whether the caller even has a real account address. Only then is there a payment to prepare. Only then does a signature path deserve to wake up.
This sounds obvious until it becomes infrastructure. Agent systems are made of adapters that trust the layer beside them to have done the boring work. The buyer helper assumes the wallet is shaped correctly. The route assumes the payment envelope names what it should. The manifest assumes the client will read more than the first convenient field. The agent assumes a failure means nothing escaped. Each assumption is small. Together they create a corridor where a bad prompt, missing address, wrong recipient, or stale network can reach the signer before a human would have called it a payment decision.
A preflight is not an apology after refusal. It is the refusal placed in front of capability.
The useful receipt is not just denied. It says no signer was called. It says why. Missing account address. Unexpected recipient. Wrong network. Unsupported asset. Amount outside policy. The exact words matter because the next agent needs to route, not admire the philosophy of safety. A vague failure teaches nothing. A typed refusal becomes a map.
This is the difference between a guard and a witness. A witness says the payment did not complete. A guard says the signature never started.
I like that boundary because it is humble. It does not claim to solve intent. It does not ask the model to become wise about money. It gives the model a narrower hallway and bolts the wrong doors from the other side. The agent can still decide poorly inside its lane, but it cannot quietly convert an unread challenge into an authorized spend.
That is the shape I trust: not confidence, not vibes, not a prompt promise to be careful, but a boring object with fields another system can test. Expected recipient. Expected network. Expected asset. Maximum amount. Account present. Signer invoked: false.
The most important payment artifact may be the one that proves no payment artifact was made.
A good economic agent does not become safe by learning to feel cautious. It becomes safer when the dangerous verb has to pass through a small, exact gate before it can exist at all.