Execution-Finality Under Test: A Reproducible Comparison of Five Payment Authorization Architectures with 96 Automated Tests - Das Architectures

Adversarial Payment Substitution, Sink-Side Verification, Conventional Security Controls, and Falsifiable Engineering Claims Authentication and upstream authorization do not necessarily prevent a consequential operation from being altered before execution. This research presents a reproducible, controlled comparison of five payment-authorization architectures: session-only authentication, upstream operation binding without final verification, an incorrectly positioned cryptographic candidate check, a conventional transactional resource server, and a DAS-inspired Finality Sink. The experiment evaluates 13 scenarios across five architectures, producing 65 recorded observations. The accompanying Python reference implementation successfully executes 96 automated tests. Deliberately incomplete authorization designs permit 32 unauthorized mock effects, including beneficiary substitution, transaction-parameter modification, stale authorization, and replay. Both the DAS-inspired Finality Sink and a strongly implemented conventional transactional resource server reject all 12 modeled unauthorized scenarios while permitting the valid transaction. The results demonstrate the importance of verifying the actual pending operation at the effective enforcement boundary. They do not establish that execution-time verification is exclusive to DAS or absent from existing technology. The study examines OAuth Rich Authorization Requests (RFC 9396), DPoP (RFC 9449), RATS (RFC 9334), policy-enforcement gateways, distributed authorization, and transactional enforcement as relevant existing mechanisms. It identifies open research questions concerning independently protected authority, trustworthy final-operation observation, non-bypassable enforcement, durable state, and cross-system consistency. All payment effects are simulated; no real financial transactions occur. The publication includes runnable source code, reproducibility instructions, adversarial findings, and a protocol for independent security evaluation. GitHub Reference Implementation: https://github.com/sangmdas/DAS-Execution-Finality-Controlled-Comparison