Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
AI agents can pay for purchases safely only when they act under a signed, limited authorization rather than holding an unrestricted card number or wallet key. In Google’s Agent Payments Protocol (AP2), a trusted surface records the user’s informed consent in a mandate. The agent presents that mandate for a specific cart, and a verifier checks that the merchant, amount, timing and other conditions are allowed before payment credentials are released.
Merchant-facing systems add a separate check: a signed, purpose-identifying agent credential lets a store distinguish a legitimate commerce request from an unknown automated client. Payment and checkout receipts then preserve evidence of what the user approved and what was actually bought. This division of duties—user authorization, action verification, merchant recognition and auditable payment—is the foundation of agentic commerce.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can an AI agent pay for something?
An agent does not need unrestricted access to a payment credential. A safer design gives it a narrowly scoped mandate, binds that mandate to a particular cart and amount, and lets a verifier approve the action only when every condition matches.
The five AP2 roles
Version 0.2 of AP2 defines five operational roles. Keeping them separate limits the damage if one component is compromised and makes it clear which party must perform each check.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Role | Responsibility |
|---|---|
| Shopping agent | Finds products, builds a cart and requests authorization for the purchase. |
| Credential provider | Holds or releases the payment credential after authorization checks succeed. |
| Merchant | Supplies product, inventory, shipping and final-cost information, then accepts or declines the order. |
| Merchant payment processor | Processes the payment and validates the payment evidence supplied with the transaction. |
| Trusted surface | Shows the user what the agent wants to do, captures informed consent and creates signed mandates. |
The transaction sequence
- The user gives the agent a task, such as finding an item from an approved merchant under a price ceiling.
- The trusted surface displays the material conditions and obtains consent. It signs an intent or checkout mandate containing those conditions.
- The agent browses, selects a product and creates a payment mandate tied to the selected cart and total.
- A verifier checks the mandate, the agent’s request and the cart. If the action is outside the approved scope, the payment credential is not released.
- The credential provider and processor complete the payment, and the system issues signed checkout and payment receipts.
AP2 calls out two different authorization questions. Mandate delegation asks whether the user authorized the agent to act at all. Action authorization asks whether this exact merchant, cart and amount satisfy the delegated conditions. Possessing a card token or API key answers neither question by itself.
What is an AP2 mandate, and what does it contain?
A mandate is a signed statement of the user’s permission. It can include the merchant or merchants the agent may use, a spending or price limit, an expiry time, refundability requirements and whether the user must confirm the cart before purchase.
Free tools Windows power users keep installed
One-click scans. No signup required.
Intent mandate versus payment mandate
An intent mandate describes the job the user wants completed. Google’s developer example includes an allowed merchant, an expiry and automatic approval while the transaction remains under a specified limit. The intent is broad enough for the agent to search and assemble a purchase, but it is still bounded by policy.
A payment mandate narrows that permission to a concrete cart and amount. The agent creates it after selecting the item and receiving the merchant’s final cost. If the total exceeds the limit, the mandate remains unsigned until an authorized manager or user explicitly approves the exception. This prevents an agent from silently converting a general shopping instruction into a larger charge.
Receipts close the evidence chain
AP2 defines checkout and payment receipts in addition to mandates. A receipt can show what was authorized, what cart and amount were presented, and how the payment credential was released. Merchants and processors can retain the signed evidence for reconciliation, customer support and disputes.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How do spending limits stop an agent from overspending?
Limits work as machine-enforced policy constraints, not as a warning displayed after the fact. Before payment, the verifier compares the requested action with every condition in the signed mandate.
| Constraint | What the verifier checks | Typical failure response |
|---|---|---|
| Merchant | Whether the seller is on the permitted-merchant list. | Reject the action or require a new mandate. |
| Amount | Whether the cart total is within the approved spending or price limit. | Keep the payment mandate unsigned until explicit approval. |
| Timing | Whether the mandate is still within its expiry window. | Reject an expired request and ask for fresh consent. |
| Refundability | Whether the purchase meets the user’s refundability condition. | Prevent payment when the merchant’s terms do not satisfy the mandate. |
| Cart confirmation | Whether the user required a final review before checkout. | Pause for confirmation instead of charging automatically. |
These checks should be fail-closed: a missing signature, malformed receipt or unavailable policy service must block payment rather than default to approval. Rate limits can also restrict how many requests an agent submits in a period, reducing damage from loops or replay attempts.
How to design a useful limit
Set the ceiling at the level of the task, not at the maximum balance available on the payment account. Pair a monetary limit with an allowed-merchant list, a short expiry and a cart-confirmation rule for purchases where substitutions or shipping fees could change the total. A mandate that says only “buy the best option” gives the verifier too little information to distinguish a legitimate substitution from an unwanted upgrade.
How does a merchant know an AI agent is legitimate?
Visa’s Trusted Agent Protocol addresses the merchant’s first question: who is sending this automated request, and is it intended for commerce? It uses linked, verifiable, purpose-identifying and time-based signed credentials carried in request headers or bodies.
What the merchant validates
- Agent identity and signature: the merchant validates the credential chain and confirms that the request was signed by the identified agent.
- Commerce purpose: the credential indicates that the interaction is for shopping or payment rather than scraping, testing or an unrelated automated task.
- Freshness: time-based credentials reduce the usefulness of a captured request and help the merchant reject stale messages.
The protocol describes two practical interaction points. During browsing, the agent retrieves product details, inventory, shipping information and the final cost. During payment, it supplies the information needed to buy the item or obtain paid access. A merchant can use the verification result to allow, limit or supplement the interaction with additional controls.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Why one signature is not enough
A valid agent signature proves which software sent a request; it does not prove that the user approved this item at this price. A robust implementation performs three independent checks: the agent identity and signature, the user or device identity when supplied, and the mandate or payment container authorizing this specific cart and amount.
What does the payment processor verify?
The processor should verify that the payment credential was released under a valid authorization and that the checkout evidence matches the transaction it is being asked to settle. It can compare the signed payment mandate, merchant data, amount and receipt before submitting the payment through the underlying rail.
Credential release must be conditional. The agent should receive a narrowly scoped token or payment result, not reusable credentials that can be copied into another merchant session. Canonicalized receipts—using one unambiguous representation of amounts, currencies, item identifiers and timestamps—help prevent two systems from interpreting the same signed data differently.
What is the difference between AP2 and Visa’s Trusted Agent Protocol?
They address different links in the chain and can be used together. AP2 focuses on proving the user’s delegated authority and binding it to a purchase; Visa’s protocol focuses on helping a merchant recognize and control an agent request.
| Comparison axis | AP2 | Visa Trusted Agent Protocol |
|---|---|---|
| Authorization artifact | Signed intent, checkout and payment mandates, plus receipts. | Linked, signed, purpose-identifying, time-based agent credentials. |
| Primary verifier | Trusted surface, merchant, credential provider and processor at their respective stages. | Merchant, with the result used to control or limit the interaction. |
| Constraint scope | Merchant, amount, timing, refundability and cart-confirmation conditions. | Agent identity, request purpose and credential freshness. |
| Payment-method coverage | Designed to work across cards, stablecoins and real-time bank transfers. | Merchant-recognition layer; the specification does not define a replacement payment rail. |
| Dispute evidence | Signed checkout and payment receipts show authorization and purchase details. | Signed request credentials show which agent initiated the interaction. |
| Deployment surface | An open protocol specification covering the end-to-end authorization flow. | A network-oriented merchant protocol for agent validation. |
Google announced AP2 on September 16, 2025, reporting collaboration with more than 60 organizations. That announcement and Visa’s separate specification indicate active ecosystem work, not a single universal production standard. Integrators still need to confirm which merchants, processors and payment rails support a given implementation.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Who is liable if an agent buys the wrong thing?
Signed evidence can establish what authority was granted and what the agent submitted, but a protocol does not by itself assign every financial loss. Liability and reimbursement depend on the merchant, processor and credential-provider agreements, the user’s mandate, the payment method’s rules and applicable law.
The evidence nevertheless improves accountability. If the receipt shows that the agent exceeded the signed limit, the verifier accepted an expired mandate or the merchant changed the total after authorization, the parties have a concrete record for investigation. If the agent stayed inside the mandate and the merchant delivered the wrong product, the dispute record points to a different part of the transaction.
What security controls should surround an agent-payment system?
Mandates and signed credentials are necessary but not sufficient. OWASP’s guidance for AI-agent payment systems highlights controls that remain important even when a protocol is correctly implemented.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Identity screening: verify users, agents and high-risk merchants before granting payment authority.
- Sanctions and compliance checks: apply required screening to the parties and transactions; an agent does not remove regulated obligations.
- Signed audit trails: retain mandates, verification results, receipts and relevant timestamps in tamper-evident storage.
- Fail-closed enforcement: block payment when a signature, policy decision or receipt cannot be validated.
- Rate limiting: cap browsing, checkout and payment attempts to contain runaway agents and replay attacks.
- Credential isolation: keep reusable payment secrets with the credential provider and release only an authorized payment operation.
- Canonical data handling: normalize currency, decimal precision, item identifiers and timestamps before signing and verification.
What happens when a purchase changes after the agent gets approval?
The agent must treat a material change as a new authorization decision. A higher total, different merchant, expired mandate or failed refundability condition no longer matches the signed scope, so the system should leave the payment mandate unsigned and request updated consent.
Requiring cart confirmation is especially useful when shipping, taxes, substitutions or availability can change between browsing and checkout. Automatic approval is appropriate only where the conditions are explicit and the final cart remains inside them.
What should businesses implement first?
- Define the actions an agent may take and express merchant, amount, timing, refundability and confirmation rules as machine-readable policy.
- Use a trusted surface to show those rules in plain language and obtain a signed mandate.
- Bind each payment mandate to one cart, currency and final amount.
- Verify the agent credential, user or device identity when available, and the mandate independently.
- Keep payment credentials behind a credential provider and release only a scoped operation.
- Generate canonical signed receipts and retain the complete audit trail.
- Test rejection paths: over-limit totals, expired mandates, unknown agents, malformed signatures, replayed requests and unavailable policy services.
This order matters because merchant recognition cannot compensate for missing user consent, and a valid user mandate cannot identify an unknown or compromised agent. Each layer answers a different trust question.
Frequently Asked Questions
Can an AI agent use my existing card, stablecoin wallet or bank account?
AP2 is designed to work across cards, stablecoins and real-time bank transfers, but support depends on the credential provider, processor and merchant implementation. The agent should receive an authorized payment operation or token rather than unrestricted reusable credentials.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Does AP2 replace the payment networks and banking rules I already use?
No. AP2 supplies authorization evidence and policy checks around a payment; the underlying card, bank-transfer or digital-asset rail still applies its own authentication, settlement, refund and compliance rules.
What if a store does not recognize the agent credential?
The merchant can reject or limit the automated request and ask for a different verification path, such as a user-present checkout. An agent signature should never be treated as a universal bypass for a merchant’s fraud, identity or risk controls.
Do signed receipts guarantee that a refund will be issued?
No. A receipt records authorization and transaction facts, which makes a dispute easier to investigate. Whether money is refunded still follows the merchant’s stated terms, the payment method’s rules and applicable consumer-protection law.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
