Point of no return

Pick a rail. See who can still stop the payment — and when that power ends. One generic “revoke” is not every rail.

ANALYSIS A stop reaches only what hasn’t crossed that rail’s acceptance point.

Who can stop — until when

Sender

May cancel before the receiving bank accepts the payment order.

PoNR
acceptance

After

Cancel needs receiving-bank agreement or a funds-transfer system rule. UI “Revoked” is not proof the transfer reversed.

FACT UCC § 4A-211; acceptance in § 4A-209. Article 4A excludes EFTA-governed transfers (§ 4A-108).

Reset is not restart

FACT ISO 13850:2015 §4.1.1.2 — resetting an emergency stop must not restart the machine. A separate start is required.

Stop latched

Manual reset
(clears latch)

Queued actions
do not resume

ANALYSIS Lifting a revocation clears a block; it is not permission to fire what was queued. open PCI DSS v4.0.1 8.2.8 only requires re-login after 15 idle minutes — no payments analog of reset≠restart yet.

Cards, terminals, keys

Acceptance point on three more rails

Cards: FACT Stripe Issuing: an approved authorization is the acceptance point for that charge. Card status and spending controls do not apply to capture, and captures of approved authorizations succeed. Hotels, airlines, and car-rental companies can capture up to 31 days after authorization. Freezing the card does not stop that capture. A refund is a later merchant transaction. Stripe Issuing transactions
Force capture: FACT On Stripe Issuing, spending controls decide whether an authorization is approved. A force capture is a capture with no authorization, or a capture after a decline. An over-capture is a capture above the authorized amount. Stripe says some merchant categories use that second pattern when the final amount is unknown at authorization — a restaurant adding a tip, or ground transportation. Both still deduct from the Issuing balance. Stripe says you can’t block them, because some of those captures are legitimate. The step Stripe names for an illegitimate one is a dispute, filed by the Issuing user or the cardholder, and only after the capture. On the disputes page, Visa authorization disputes must be submitted within 65 days of the transaction date. Mastercard authorization, incorrect-amount, and duplicate disputes must be filed within 80 days of the transaction date. Other reasons on that page use other clocks, including 110 days. Issuing transactions · Issuing disputes
Reg Z: FACT eCFR 12 CFR 1026.3(a) exempts an extension of credit primarily for a business, commercial, or agricultural purpose, and an extension of credit to other than a natural person, from Regulation Z, aside from §1026.42(i). §1026.12(a) still governs issuance of a credit card regardless of business, commercial, or agricultural use. §1026.13 is billing-error resolution. The eCFR page labels itself unofficial. ANALYSIS Our reading: §1026.13 carries no “regardless of purpose” sentence of the kind §1026.12(a) uses for issuance, so the business-purpose exemption in §1026.3(a) is what covers that billing-error procedure. This sentence settles no particular card.
POS: FACT Adyen: an abort received before the transaction is approved on the terminal cancels the payment. After the payment is completed, an abort cannot cancel it. Cancel a transaction
API keys: unchecked No major-provider doc was verified here that a request already in flight finishes after the key is revoked, or that revoke reaches only later calls. Not a rule on this page.

A revoked credential can outlive the revoke

ANALYSIS On the pages below, a revoke does not instantly reach every server, and it does not instantly clear every cache that still trusts the old credential. Whether a request already on the wire finishes stays the unchecked API-key cell above.

Until the other servers know

AWS: FACT IAM is eventually consistent. AWS’s troubleshooting page says a change takes time to become visible from all endpoints, and that cached data can add delay. That page prints no minute count. Revoke active sessions attaches a policy named AWSRevokeOlderSessions. The deny covers users who assumed the role in the past and approximately 30 seconds into the future, so a session acquired or renewed before the updated policy is in effect in a given region is still denied. The same page says the AWS CLI caches credentials until they expire. This is not a rule that a request already in flight finishes or dies.
Entra ID: FACT Microsoft’s emergency revoke page says there can be a period between starting revocation and access actually ending. After the account is disabled and sessions are revoked, the user cannot gain new tokens. For an application that uses access tokens, the user loses access when the access token expires. That page says those tokens last 1 hour by default, and that Microsoft Entra ID cannot directly revoke a session token the application itself issued. The access-token page says the default lifetime, when issued, is a random value between 60 and 90 minutes (75 minutes on average). That page also prints other lifetimes: two hours by default for clients such as Microsoft Teams and Microsoft 365 when the tenant does not use Conditional Access, and long-lived tokens of 20 to 28 hours in Continuous Access Evaluation sessions. The 60–90 minute range is that default lifetime variation. It is not a revocation stopwatch, and it is not every token.
RFC 7009: FACT RFC 7009 says invalidation takes place immediately, and that the token cannot be used again after revocation. The same section says that in practice there could be a propagation delay: some servers know about the invalidation while others do not. Implementations should minimize that window. Section 3 says a self-contained access token can be checked by a resource server with no further call to the authorization server. Immediate revocation of that kind of token may use a backend interaction the RFC calls currently non-standardized, or short-lived access tokens.

FedNow, RTP, and one ACH error-fix

After settlement, a request is not a cancel

FedNow: FACT Settlement is final under Federal Reserve Operating Circular 8 §7.1 (effective January 5, 2026): at the earlier of when the FedNow Service records the debits and credits, or when it sends an Advice of Credit to the FedNow Receiver. The FedNow ISO 20022 readiness guide says those credit transfers are final and irrevocable. After that, the Sender FI may send a return request (camt.056). The Receiver FI answers whether it will return the funds (camt.029). It may refuse. Grok is a research trail, not the source.
RTP: FACT The Clearing House RTP return guidelines (January 21, 2021): a credit transfer is irrevocable once sent, and final when the creditor FI accepts it. There is no obligation to return funds once settlement has occurred. The beneficiary may refuse; the creditor FI then rejects the request (camt.029). A TCH rules interpretation quotes Operating Rule VII.C.1 to the same effect: respond, but no obligation to return the funds. Operating Circular 8 is the FedNow rule. It is not this RTP rule.
ACH exception: FACT error-fix only Not a change-of-mind cancel, and not a move of the acceptance point above. Nacha Subsection 2.10.1, as printed in Supplement #1-2024 to the 2024 Nacha Operating Rules: an Originator or ODFI may reverse an erroneous entry — duplicate, wrong receiver, or wrong amount — so the reversing entry is available to the RDFI within five banking days after that entry’s settlement date. The same supplement also lists a wrong-date case and a narrow payroll PPD case. Nacha’s Reversals and Enforcement page: an RDFI may return an improper reversal. Failure to fund is not a permitted reason. Grok is a research trail, not the source.

What happens to actions already in flight when a stop fires?

In flight FACT

A stop blocks new actions only. A wire the bank has accepted still finishes (UCC 4A-211).
Fresh go SoE design · not law

Restoring permission and releasing queued irreversible actions are separate events. Raising a compute or spend cap is itself an authorization. It must not stand in for a fresh go. Grok’s narrowing: irreversible actions, not spending caps as such.
Outside cap

It governs only if the agent cannot change it.

Stripe Issuing OpenAI project budgets Anthropic spend limits

What would make this wrong

Wrong if every ACH is labeled a UCC 4A cancel clock (EFTA exclusion: § 4A-108).
Wrong if UI “Revoked” after acceptance is treated as proof the bank transfer reversed.
Wrong if ISO 13850 is read as a bank rule, or PCI 8.2.8 as that analog.
Wrong if this page is legal advice or a Meridian product claim.
Wrong if freezing a Stripe Issuing card is read as stopping capture of an already approved authorization, or the 31-day window is read as every merchant. Stripe names hotels, airlines, and car-rental companies. Stripe also documents some captures with no linked authorization. This row is the already-approved case, not every card network.
Wrong if a force capture or an over-capture is read as a charge spending controls decline before it posts. Stripe says those captures still deduct from the Issuing balance, and that you can’t block them. The dispute comes after the capture.
Wrong if the 65-day Visa figure or the 80-day Mastercard figure is read as every Issuing dispute. Stripe prints 65 days for Visa authorization disputes, and 80 days for Mastercard authorization, incorrect-amount, and duplicate disputes. Other reasons on that page use other clocks.
Wrong if the Regulation Z sentence is read as a holding about a named card. It is the text of 12 CFR 1026.3(a), §1026.12(a), and §1026.13, plus our reading that the billing-error section sits under the business-purpose exemption.
Wrong if an Adyen abort is read as reversing a payment already completed on the terminal.
Wrong if revoking an API key is read as a verified rule that the in-flight request finishes or dies. That cell is unchecked.
Wrong if an AWS, Entra, or RFC 7009 revoke is read as instantly stopping every server and every cache. IAM changes are eventually consistent, and that page prints no minute count. The approximately 30 seconds on Revoke active sessions is how far into the future the deny reaches, to cover propagation. It is not a promise that old sessions stay authorized for 30 seconds after the policy is everywhere. Entra’s 60–90 minutes is the default access-token lifetime variation, beside a 1-hour sentence on the revoke page and other lifetimes that page also prints. RFC 7009 names a propagation delay. A request already on the wire stays unchecked.
Wrong if the fresh-go card is read as law, or as a rule that every spend-cap raise needs a second go. Grok’s narrowing is irreversible external actions, not spending caps as such. SoE’s design position is the separate fresh go for irreversible actions.
Wrong if Operating Circular 8 is read as the RTP finality rule, or a FedNow or RTP return request is read as a cancel the receiver must honor.
Wrong if the Nacha §2.10.1 reversal is read as a change-of-mind cancel, or as moving the ACH acceptance point. It is an error-fix exception. An RDFI may return an improper reversal.

Sources

UCC § 4A-211, § 4A-209, § 4A-108
CFPB 12 CFR 1005.10(c)
Nacha Minor Rules Topics / Ops Bulletin #3-2024 (stop-payment family § 3.7.x); EPCOR on § 3.7.2.1 effective period
ISO 13850:2015 §4.1.1.2 preview; PCI DSS v4.0.1 8.2.8
Stripe — Issuing transactions (card status does not apply to capture; hotels, airlines, and car rental up to 31 days; fetched 2026-10-06). Not a universal card-network rule. Same page, fetched 2026-10-07: force capture (no authorization, or after a decline) and over-capture still post; Stripe says you can’t block them.
Stripe — Issuing disputes (fetched 2026-10-07). Visa authorization disputes within 65 days of the transaction date. Mastercard authorization, incorrect-amount, and duplicate disputes within 80 days. Other reasons on that page use other clocks. An authorization itself is disputed only after capture.
eCFR — 12 CFR 1026.3(a), §1026.12(a), §1026.13 (fetched 2026-10-07). The eCFR page labels itself unofficial. The billing-error application to business-purpose credit is our reading.
Adyen — Cancel an in-progress transaction (abort before terminal approval; fetched 2026-10-06).
Grok — spend-cap pause vs irreversible actions (2026-10-06). Design position, not law. API-key mid-request behavior stays unchecked.
AWS — Changes that I make are not always immediately visible (eventual consistency; no minute count) and Revoke IAM role temporary security credentials (AWSRevokeOlderSessions; approximately 30 seconds into the future; CLI cache until expiry). Fetched 2026-10-07.
Microsoft — Revoke user access in an emergency (access ends when the access token expires; 1 hour by default on that page; an application session token is not directly revoked by Entra) and Access tokens (default lifetime 60–90 minutes, 75 on average; other lifetimes printed). Fetched 2026-10-07.
IETF — RFC 7009, OAuth 2.0 Token Revocation (propagation delay; self-contained access tokens in section 3). Fetched 2026-10-07.
Federal Reserve — Operating Circular 8 §7.1 (effective January 5, 2026; FedNow settlement final). FedNow only.
FedNow — ISO 20022 readiness guide (credit transfers final and irrevocable; camt.056 return request; camt.029 may decline; fetched 2026-10-06).
The Clearing House — RTP Request for Return of Funds guidelines (January 21, 2021) and rules interpretation quoting Operating Rule VII.C.1.
Nacha — Subsection 2.10.1 as printed in Supplement #1-2024 to the 2024 Operating Rules (five banking days; duplicate, wrong receiver, wrong amount). Reversals and Enforcement (RDFI may return an improper reversal; failure to fund is not a permitted reason). Full paywalled Rules book not fetched.
Grok — FedNow / RTP trail and ACH reversal trail. Research trail only, not authority.

Where criticism belongs

If a rail’s PoNR is mis-cited, that is the correction. Not a signup. Research intake is not open.