Yeah, let's not hand that sort of data to the credit card companies. It might be a good use case for homomorphic encryption--where the transaction processor computes a go/no-go result without knowing why (and then you scan a QR code and decrypt on your device).

I was thinking of having it decoupled from payments, sort of a more customizable replacement for the ID-checks that we currently do when buying alcohol. I think you could do zero-knowledge trickery to avoid the privacy problems.

But then again, an API for a third party to cut off your access to resources might be too juicy of an abuse-enabler to be worth building.