An agentic mandate is a user's recorded, usually cryptographically signed, instruction that authorises an AI agent to buy something or make a payment on their behalf, and that sets the limits of that authority: what may be bought, from whom, for how much and by when. Merchants, payment providers and banks check it to confirm that a purchase made by software reflects what the person actually approved.
The term is most closely tied to Google's Agent Payments Protocol (AP2), which made mandates its central building block, but the idea runs through agentic commerce generally. It borrows the word from banking, where a direct debit mandate lets a company pull money from an account. An agentic mandate differs because the agent, not the merchant, chooses the purchase within the rules, and because the record is designed to be machine-verifiable.
Agentic mandates in plain terms
Imagine leaving a signed note for a house-sitter: "You may buy groceries at the corner shop, up to $50 a week, and nothing else." The note tells the sitter what they may do, tells the shopkeeper the sitter is allowed to spend your money, and gives everyone something to point to if a bottle of champagne appears on the bill.
An agentic mandate is that note in digital form. Instead of a handwritten signature it carries a digital one that cannot easily be forged or altered, and instead of a shopkeeper reading it, computers at the shop and the bank check it automatically. If the agent tries to spend beyond the limits, the payment can be refused, and if something goes wrong later, the note shows who agreed to what.
Mandates in the Agent Payments Protocol
When Google announced AP2 on 16 September 2025, it described mandates as tamper-proof, cryptographically signed digital contracts carried as verifiable credentials. Version 0.1 set out a chain of records:
- Intent Mandate. The user's request and conditions, such as a price ceiling, timing or merchant list. It matters most when the user will not be present at the moment of purchase.
- Cart Mandate. A record of the exact items and price, created when the user, or the agent under a prior instruction, approves a specific cart.
- Payment Mandate. Information shared with the payment network and card issuer signalling that an agent was involved and whether the user was present.
Version 0.2, released on 28 April 2026 when Google donated AP2 to the FIDO Alliance, reorganised this into a Checkout Mandate and a Payment Mandate, each with an open stage that records the user's constraints before a purchase is final and a closed stage bound to one finalised checkout and amount. The same release added fuller support for human-not-present payments.
How a mandate is created and checked
A mandate is signed with a private key held on the user's device or by a trusted credential provider, and anyone holding the matching public key can verify the digital signature. Because each mandate references the previous one, the chain from first instruction to final payment forms an audit trail that neither side can quietly rewrite. In a human-present purchase the user signs the cart in real time, often with a passkey or biometric prompt. In a delegated purchase, such as buying concert tickets the moment they go on sale, the user signs the intent in advance and the agent creates the cart mandate when the conditions are met.
Comparison with other forms of authorisation
| Form | Who decides the purchase | Typical record |
|---|---|---|
| Card on file or recurring payment | Merchant, for a fixed or agreed charge | Merchant's stored consent |
| Direct debit mandate | Merchant, within the agreed scheme rules | Signed or electronic bank mandate |
| Open banking consent | User approves each payment initiation or a set of payments | Consent held by the bank and provider |
| Agentic mandate | AI agent, within user-set limits | Signed, verifiable credential |
Other protocols handle the same problem differently. The Agentic Commerce Protocol (ACP) relies on a delegated payment token limited to one merchant and a set amount, which constrains what the agent can spend without a separate signed intent. Google and Mastercard co-developed a related standard, Verifiable Intent, which Google said in April 2026 was also being donated to FIDO.
Limitations and open questions
- Interpretation. A mandate records the user's words and limits, not what they meant; vague instructions can still lead to unwanted purchases that sit within the rules.
- Legal weight. Whether a signed mandate settles a chargeback or an unauthorised-payment claim depends on card network rules and national law, which were written for human cardholders and had not been fully adapted as of November 2026.
- Authentication rules. Requirements such as strong customer authentication in Europe expect the payer to take part, so delegated mandates must fit within exemptions or be authenticated when first signed.
- Key security. A mandate is only as safe as the key that signs it; a compromised device or account lets an attacker create valid-looking authority.