SoFi Bank put SoFiUSD on Mastercard's settlement layer. Authorization still rides the card rails and the merchant sees nothing change, but the interbank fund movement happens on-chain, around the clock, with no batch window and no correspondent float. For the first time, issuers and acquirers get to choose their settlement medium.
A bank buys a modern payment platform and keeps the 2019 team structure, the same escalation matrix, the same three-person on-call rotation. The platform ships daily. The governance model says 90 days. Most modernization failures are operating-model failures, and the org chart defeats the architecture every time.
A duplicate payment in production is not an edge case. It is the control plane showing you what you never modeled. A retried request can land as a final success on one rail and a settlement reject on another, look clean on the dashboard, and still move two accounts twice. Best-effort dedupe is not a control.
A payment bot did not go rogue - the architecture did. A timeout produced two valid-looking instructions for the same payout, because a downstream retry never learned the first was already in flight. Mandate-based authorization like AP2 still needs a runtime control plane with real state discipline, not policy in a config file.
An invoice agent hits a transient timeout, retries, and two payments clear to the same vendor. The model calls it success. Ops calls it a week of cleanup. Spend limits and roles are a speed bump. Real delegated authority is a delegation object, policy on every attempt, ledger-bound idempotency, and an instant kill switch.
A wire investigation is the moment confidence breaks - the payment has moved and the clock is running. The Fedwire Funds Service changes planned for November 2026 turn investigation messages into structured workflows and add a Create Payment Return feature. Treat it as a rail feature, not a back-office patch.