In short. AP2 represents shopper authorisation with signed mandates that verifiers check against the checkout and any user-approved constraints.
Definition: As of 17 October 2026, the Agent Payments Protocol (AP2) represents a shopper's authorisation through cryptographically signed mandates: records of an approved checkout or payment. A shopper can approve a specific transaction directly or approve constraints that an agent must satisfy when completing a purchase autonomously.
Key facts
- The AP2 specification defines Checkout Mandates and Payment Mandates, linked through a cryptographic hash of the merchant's signed checkout.
- The Agent Authorization model provides two trust approaches: User Credential and Trusted Agent Provider.
- The Payment Mandate schema includes the payee, payment amount, payment instrument and a transaction identifier derived from the signed checkout.
What does the shopper approve?
The AP2 specification distinguishes direct and autonomous operation. In the direct, human-present mode, the shopper sees the final checkout and explicitly approves both the checkout and its payment. The resulting closed mandates apply to that particular transaction.
In the autonomous, human-not-present mode, the shopper first approves open Checkout and Payment Mandates. An open mandate contains constraints on the final transaction and identifies the agent's public key in the cnf claim. The agent later signs closed mandates with its own key and presents them alongside the shopper-approved open mandates.
A Trusted Surface is the interface responsible for obtaining informed consent before creating a user-signed mandate. The specification requires this role to use deterministic code, with no processing delegated to a language model. Verifiers receive closed mandates in either mode; autonomous operation adds the evidence of delegated authority.
Who is trusted to record consent?
The AP2 specification treats an agent as a potential attacker whenever a role uses one. Signed mandates and deterministic verification provide the basis for checking its authority.
The Agent Authorization model defines a verifier as the party checking whether an agent has authority to act. Its User Credential approach relies on an external credential issuer trusted by that verifier. The issuer is trusted to ensure that the Trusted Surface creates mandates only after appropriate user consent and authorisation. This permits a credential to delegate authority to different agents without a separate trust relationship with each agent.
In the Trusted Agent Provider approach, the verifier trusts the agent's provider directly to obtain consent and construct mandates. This approach requires no pre-issued user credential. The provider must keep its signing key inaccessible to the agent and prevent its use without the Trusted Surface.
The same model requires verification of the mandate chain, preservation of values approved in open mandates, and evaluation of every constraint. An unknown constraint fails evaluation.
What must a merchant or payment provider check?
Under the AP2 verification rules, the merchant verifies the Checkout Mandate and checks that checkout_hash matches its signed checkout. Where open mandates are included, it also evaluates their constraints. The credential provider verifies the Payment Mandate before releasing a payment credential, and the merchant payment processor checks that the credential is scoped to the checkout. These checks must run in deterministic code, including when the surrounding role uses an agent.
The Payment Mandate examples include this constraint inside a decoded open mandate:
{
"type": "payment.amount_range",
"currency": "USD",
"max": 20000,
"min": 0
}
This fragment defines an amount range; it is part of the mandate content, which also needs cryptographic protection. The schema expresses these limits in minor currency units. Evaluation checks the payment amount against the range and requires matching currencies. Other defined constraints restrict permitted payees or payment instruments.
The specification also requires checkout and payment receipts after acceptance or rejection. Mandates and receipts can be combined as transaction evidence in a dispute; dispute-resolution procedures and retention requirements remain outside its scope.
Related terms
FAQ
Can an agent approve a purchase while I am absent?
Yes. In the autonomous mode, your earlier approval covers open mandates. The agent signs the final mandates, and verifiers check them against that delegated authority and its constraints.
What happens if a verifier cannot evaluate a constraint?
The Agent Authorization error definitions provide unresolved_constraint for an unknown or unverifiable constraint. This can signal a return to direct approval of closed mandates or another flow without an agent.
Sources
- AP2, "Agentic Payment Protocol (v0.2)", undated
- AP2, "Agent Authorization", undated
- AP2, "Payment Mandate", undated
Check how a page reads to answer engines. Open the GEO score analyzer