How do we know an AI agent is allowed to spend this money on someone’s behalf? We need more than proof that software was recognized. A useful binding record connects the person or organization that delegated authority to the agent, defines what it may do, ties that permission to the actual checkout and payment, and preserves evidence for later review.
Current approaches divide those checks across identity, authorization, payment execution, and receipts. The sources reviewed do not establish one legally settled record for every payment rail or jurisdiction.
As an Amazon Associate I earn from qualifying purchases.
What a binding record needs to prove
There are two separate questions: Which agent is acting? and Did the person or organization authorize this action? An agent-recognition signal can help answer the first, but recognition alone does not establish permission to make a particular purchase. Mastercard frames the related questions as “Who is acting?”, “What was authorized?”, and “What is the agent allowed to do?”
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For a payment to be reviewable later, the evidence also needs to connect the permission to the transaction that was actually attempted or completed. That means keeping the relevant identity evidence, authorization, checkout details, payment evidence, and their references together—not treating an agent’s identity as a substitute for proof of consent.
#1 Best Overall
How the checks fit together
1. Identify the agent and link it to the interaction
Visa’s Trusted Agent Protocol describes a signed agent-recognition message and an identity object that links the interaction to consumer or device data. A merchant can retrieve public keys and verify the message signature. The protocol specifies fields such as the target authority and path, creation and expiry timestamps, key identifier, signature algorithm, a tag indicating browser or payer authentication, and a nonce.
Visa says the creation and expiry times should be no more than eight minutes apart. It also describes replay protection through tracking recent nonces. These are protocol-specific details, not universal requirements for agent payments. Even when the signature checks out, the merchant’s acceptance remains subject to its own decisions and the protocol’s rules.
2. Establish the scope of the user’s permission
Google’s Agent Payments Protocol (AP2) represents delegation with a user-approved mandate. During delegation, the agent presents mandate content on a trusted surface for the user to approve; the approved mandate is then returned to the agent. If a verifier later asks for proof of authority, the agent presents a relevant mandate, and the verifier checks its integrity and whether the requested action fits its terms.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThis is the distinction between broad task permission and permission for a particular purchase. An authorization can describe a task or impose constraints; the relevant verifier must determine whether the proposed action falls within what was approved.
Rank #3
3. Bind the permission to the assembled checkout
AP2 defines both Checkout and Payment Mandates. Its Checkout Mandate is intended to give the merchant cryptographic evidence that the agent is authorized to purchase the assembled checkout. The merchant verifies the mandate and checkout hash. If the mandate is open-ended but constrained, the merchant checks those constraints against the final checkout.
The payment side involves additional actors. Credential providers and networks verify the Payment Mandate before returning payment credentials; the merchant’s payment processor checks that the credential is scoped to the checkout. In other words, a valid authorization and a valid payment credential are related checks, but different participants perform them.
4. Preserve evidence that can be checked later
AP2 specifies checkout and payment receipts. For a dispute, its described verification steps include checking mandate integrity and matching references to mandate hashes. Those links can help a reviewer reconstruct which authorization applied to which checkout and payment evidence.
A traceable technical record can support an audit or dispute, but it does not by itself determine who is legally liable. The IMF identifies traceability, consent, and liability as questions raised by mandate-based authorization, particularly when each payment does not have its own transaction-level instruction.
Best Value
How the approaches differ
Visa’s protocol description emphasizes signed recognition and linked consumer or device identity. AP2 describes a mandate-based flow that connects delegation to checkout and payment evidence. Mastercard’s framework supplies a broader set of design categories. These are different lenses and protocol approaches, not interchangeable labels for a single shared record.
| Question | Visa Trusted Agent Protocol | Google AP2 | Mastercard framework |
|---|---|---|---|
| Identity | Signed agent recognition linked to consumer or device data; merchants can verify the message using public keys. | The described flow centers on mandates presented to a verifier; the cited AP2 material does not establish the same recognition-message mechanism. | Identity is one of five named pillars in Mastercard’s September 30, 2026 framework. |
| User intent | The cited protocol description covers recognition and linked identity; it does not, by itself, establish user approval of a specific purchase. | A user-approved mandate is presented when authority must be demonstrated, and a Checkout Mandate can bind authorization to an assembled checkout. | Intent is a named pillar; Mastercard says user intent must be explicit, verifiable, and trusted. |
| Controls | Timestamps and nonces support message freshness and replay protection under the protocol. | Mandates can carry constraints; the relevant verifier checks whether the requested action or final checkout fits them. | Controls is a named pillar. The framework description does not specify a universal set of spend limits or enforcement rules. |
| Execution and evidence | The cited protocol description focuses on merchant recognition and verification; it does not define the AP2 receipt flow. | Merchants, credential providers, networks, and merchant payment processors have distinct verification roles; checkout and payment receipts support later checks. | Trusted execution and intelligence are two further named pillars; the framework is not an independently validated measurement model. |
| Governance and liability | Acceptance remains subject to merchant decisions and protocol rules. | Technical verification does not settle legal liability across jurisdictions. | Mastercard’s framework is a named approach, not evidence of a settled cross-industry standard. FIDO’s standards work is ongoing. |
What this means for a payment record
A practical record should make it possible to answer, from connected evidence rather than inference, who delegated authority, which agent acted, what scope or constraints applied, what checkout was presented, which payment evidence was accepted, and how those items are linked. The mechanisms described above offer examples of how pieces of that record can be represented and checked; none establishes a complete, universal legal record for every payment context.
- Identity: retain evidence identifying the agent and, where the system provides it, its link to the consumer or device.
- Authority: retain the approved mandate or equivalent authorization, including any scope, constraints, or expiry that applies.
- Transaction binding: retain the checkout reference or hash and evidence that the applicable authorization was checked against it.
- Payment and review: retain the payment receipt and references needed to trace it back to the mandate and checkout.
This checklist describes the evidence a reviewer would need to follow the chain; it is not a claim that every framework implements the same record fields or that satisfying a technical check resolves consent or liability questions.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhy the record is still evolving
On April 28, 2026, the FIDO Alliance announced collaborative standards work involving AP2. The announcement says contributions will be reviewed and developed through FIDO’s standards process, so it should be read as work underway rather than a finished universal standard. Mastercard’s September 30, 2026 framework names five pillars—identity, intent, controls, trusted execution, and intelligence—but that framework is a set of categories, not an independently validated measurement model.
The unresolved questions are not only technical. A system may be able to verify a signature, mandate, checkout hash, or receipt while the applicable rules still need to determine whether consent was adequate and which party is responsible when something goes wrong. Those questions depend on the payment arrangement and jurisdiction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
