Agent Mandate: What It Is and How It Works

An Agent Mandate is the piece of agentic commerce that answers a simple question with a verifiable record: did the consumer actually authorize this AI agent to do this specific thing?

The Mandate concept was popularized by Google's Agent Payments Protocol (AP2) launch in September 2025 but the pattern is now used across multiple agentic commerce protocols including Visa TAP, Mastercard Agent Pay, and UCP.

A typical Mandate scopes:

• Amount caps. Maximum per-transaction and aggregate spend.
• Merchants or payees. Which merchants a checkout may use or which payees may receive a payment.
• Time window. When the authorization is valid (single-use, recurring within a window, expiry date).
• Frequency. One-shot vs recurring vs unlimited within scope.
• Required confirmations. What thresholds require fresh consumer approval.

The Mandate is signed by the consumer (typically through their wallet, bank app, or payment provider) and travels with the transaction so merchants and payment networks can verify it cryptographically.

Three flows define how Mandates operate:

1. Mandate creation. The consumer creates and signs a Mandate through a trusted source (their issuing bank, payment provider, or wallet). The Mandate is cryptographically tied to the consumer's payment credentials and keeps them out of the agent's reach. Modern implementations support biometric signing (Face ID, fingerprint) for low-friction creation.

2. Mandate presentation. When the agent is ready to transact (e.g., after the consumer has selected a product through a UCP or ACP shopping flow), it presents the Mandate alongside the transaction request. The Mandate travels with the payload.

3. Mandate verification. AP2 assigns verification by role. The Merchant verifies the Checkout Mandate, credential providers and applicable networks verify the Payment Mandate, and the merchant payment processor verifies that the payment credential is scoped to the checkout. A role may delegate its checks to a technology provider, which then follows that role's verification rules.

The pattern is the same across protocols even when implementation details differ. AP2 specifies an open Mandate format. Visa TAP and Mastercard Agent Pay use Mandate-style primitives integrated with their tokenization frameworks.

Without Mandates, AI agents shopping on a consumer's behalf operate in a trust vacuum. The merchant doesn't know if the agent had authorization. The network doesn't know if the spend is in-scope. The consumer doesn't have an audit trail. Disputes default to whoever speaks loudest.

Mandates change that pattern at three layers:

1. Consumer. Fine-grained, time-bounded control over what the agent can do. AP2 v0.2 supports expiration and constraints, and a normative dynamic revocation mechanism is still to come.
2. Merchant. Auditable evidence of consumer authorization. Disputes have a cryptographic record. Higher-value agent transactions become safe to accept.
3. Network. Real-time fraud signals. A transaction that doesn't match its Mandate is denied at network authorization time, before it reaches the merchant. Mismatch patterns feed cross-network agent-fraud detection.

The Mandate is what lets agent transactions grow beyond the small-amount caps networks otherwise impose. With it, recurring orders, subscriptions, replenishment and larger agent purchases can clear safely.

For a retailer, Mandates arrive through the payment stack. The part of agent commerce that is in your hands today sits earlier in the journey: whether the agent finds and understands your products well enough to put them in the cart at all. That is the product information work Paz handles.