It does work like this.

And if you host your own Bolt Card then you can set up your own payment rules on your hosting server.

There is a fair amount of innovation possible here, from the obvious limit per tx or per day to only paying invoices from certain nodes or checking with your app for larger amount authorisation or other checks.