Agents

Who may act for the organisation: the principal behind each agent, its operator of record, its key, and the kill switch. Suspension withdraws every mandate the agent holds in one action, so nothing further is authorised. It withdraws authority, not funds: it cannot recall a transaction already submitted, and it cannot freeze a token on a ledger.

Why several agents rather than one: one all-powerful agent is one key with all authority, which is the failure this product exists to prevent. Separate agents keep mandates narrow, keep the kill switch's blast radius small, and make every payment attributable to a function.