Compare

Custodial agent walletCard tokenFindBuyAgent (your wallet)
Who holds keysThe serviceThe issuer holds the card credentialYou
Where limits are enforcedIn the serviceOn the token, if a mandate existsIn your rules, then in your signature
Who can change limitsThe serviceYou and the issuerYou, with a new signature