Would your CFO sign off on an AI moving money? Only if its limits hold even when the agent goes wrong. Each test builds what a misbehaving agent, or someone with a stolen key, would send, and asks the XRP Ledger's own engine what would happen (simulate). Nothing is signed, sent or paid, so try them as often as you like. Each agent's page answers the other three questions: what it may do, who it can pay, and how to prove what it did.
The pool has deposit authorization on: it takes money only from accounts holding Korsie's credential, so unknown money can never mix with learners' balances.
The pay-in address requires a destination tag, the learner's wallet code, so money can never arrive without saying whose it is.
Its budget is locked in weekly escrows. The ledger refuses a claim before its date, whatever the agent decides.
Every conversion names the least it must deliver (DeliverMin). The ledger delivers at least that, or nothing moves.
Only an account the family delegated to may pay from theirs, and only the family can grant or revoke that.
Each agent's account holds only its budget, so the most a compromised agent could ever lose is that.
The reserve's own key is disabled, and its signer list needs the bursar and the principal together. One signature is refused.
Payees come only from the mandate a person signed. Korsie's policy engine rejects anyone else, and the signer checks again before signing.
The signer pays only accounts holding Korsie's KorsiePayee credential on the ledger. Korsie can withdraw one at any time, and every agent stops paying that account.
Two more stops to try on the agents' own pages: an account's owner can take its agent's key away on the ledger, after which the ledger refuses anything it signs; and Korsie can withdraw its verification of a supplier, after which no agent can pay it.