Agent Payment Mandates: How Verifiable Authorization Works

An agent payment mandate is a verifiable, tamper-evident record that proves a human authorized an agent to spend in a specific way. Popularized by AP2, the Agent Payments Protocol from Google and partners, a mandate captures what the user agreed to, signs it so it cannot be altered, and lets any party in the transaction confirm that the agent is acting within real authority. In short, a mandate is the cryptographic answer to the question every merchant and payment provider asks: did a person actually authorize this?

This post explains what mandates are, the difference between intent and cart mandates, and how a control plane enforces them so that authorization on paper becomes authorization in practice.

Why mandates exist

When an agent presents a payment, the receiving side faces a trust problem. Was this authorized by a human, or did the agent invent it, get tricked by a prompt injection, or exceed what it was allowed to do? Self-reported authority is not enough; an agent can claim anything. Mandates solve this by making authorization verifiable. The user's authorization is captured in a signed record, so the agent's authority can be checked rather than trusted. This is the foundation that lets merchants accept agent payments without treating them as fraud risk.

Mandates pair naturally with agent identity. Identity says which agent and which owner; a mandate says what that owner authorized. One without the other is incomplete.

Intent mandates versus cart mandates

AP2 distinguishes two kinds of mandate, and the difference is important because they fit different shopping flows.

Intent mandates: bounded autonomy

An intent mandate authorizes a goal with constraints before the specifics are known. The human says what they want and the limits that apply, and the agent is free to find and buy within those bounds. This is what makes genuinely autonomous agent commerce possible: you do not have to be present for the final click, because you authorized the shape of the purchase in advance. The constraints in the mandate, amount, merchant type, time window, are exactly the limits a control plane then enforces.

Cart mandates: precise authorization

A cart mandate authorizes a specific, finalized cart, these items, this total, this merchant. It is the closest analog to a human clicking "buy". Cart mandates are ideal when the human is present at checkout or when you want explicit confirmation of the exact purchase. There is no ambiguity about what was authorized because the mandate names it precisely.

How a control plane enforces mandates

A mandate proves what was authorized. It does not, by itself, stop an agent from trying to spend outside it. That is the job of enforcement, and it is where a control plane comes in. The flow looks like this:

1. Bind the mandate to identity. The mandate is associated with a specific agent and its named owner, so authority is never ambiguous.
2. Translate the mandate into policy. The limits in the mandate, amount, merchant scope, time window, become enforceable rules in your spend controls.
3. Check every transaction against the mandate. When the agent tries to pay, the control plane verifies the payment falls within the mandate's bounds before money moves. Out-of-bounds attempts are declined at the boundary.
4. Gate the edges with a human. Where a payment is near a limit or unusual, route it for human approval rather than relying on the mandate alone.
5. Record the mandate in the audit trail. Every payment links back to the mandate that authorized it, so the audit trail shows not just that money moved but under which authorization.

This is the practical meaning of "never move money without policy". The mandate is the authorization; the control plane is what makes sure no payment escapes it.

Mandates and the wider standards

Mandates are one layer of agentic commerce. They handle authorization. Checkout standards like ACP handle completing a purchase, and micropayment rails like x402 handle pay-per-call. A real transaction may touch more than one. For the full picture of how these fit together, read agentic commerce explained.

Common questions

Is a mandate the same as an approval?

No. A mandate is authorization granted in advance, the user defining what an agent may do. An approval is a decision made in the moment on a specific transaction. They complement each other: an intent mandate sets the bounds, and you can still gate edge cases for human approval. See human in the loop payments.

Can an agent exceed its mandate?

It can try, which is exactly why enforcement matters. A mandate on its own is a statement of authority. A control plane checks each payment against the mandate and declines anything outside it before money moves, so attempts to exceed it fail rather than slip through.

Do I need mandates if I already have spend controls?

They serve different purposes. Spend controls are your rules. A mandate is verifiable proof of what a specific human authorized, which merchants and providers can check. Together they give you both enforceable limits and provable authorization, which is stronger than either alone.

What makes a mandate trustworthy?

It is signed and tamper-evident, so any party can verify it was not altered and that it reflects real human authorization. That verifiability is the whole point; without it, a mandate is just a claim. See our security overview.

The takeaway

Agent payment mandates turn "the agent says it is allowed" into "here is verifiable proof a human authorized it". Intent mandates enable bounded autonomy; cart mandates give precise, click-equivalent authorization. But a mandate is only as strong as its enforcement, which is why a control plane binds it to identity, translates it into policy, checks every transaction against it, and records it in the audit trail. That is how authorization on paper becomes money that never moves without it. Next, compare the best agent payment platforms or see how it works.