Why it matters
Analysis: The useful design question is where a payment policy is enforced. Test explicit recipient and amount limits at the execution boundary, with logs that distinguish a requested payment from an executed, unauthorized transfer.
What remains uncertain
This is a proponent-authored preprint using a simulated bank and one payment-tool schema. Zero observed failures in those tests does not imply zero production risk.