SignorCrypto note · AI
Agent Payments Protocol (AP2): How Mandates Authorize AI Payments
How AP2 turns user intent into signed mandates for agent purchases, what v0.2 adds and what stays open
AP2 (Agent Payments Protocol) is an open protocol that lets AI agents initiate payments on a user's behalf, while binding each transaction to verifiable, cryptographically signed records called mandates. Google introduced it on 16 September 2025 as an extension of the Agent2Agent (A2A) protocol. Version 0.2, released on 28 April 2026 together with the transfer of the project to the FIDO Alliance, adds "Human Not Present" payments, in which an agent pays under instructions the user authorized in advance. The core question AP2 answers is: how can a merchant and a payment network verify what the user actually approved?
Why agent payments break the checkout model
The AP2 documentation starts from a basic assumption of current payment systems: a person clicks "buy" on a trusted website. When an autonomous agent starts the payment, three questions follow. Authorization asks whether the user gave this agent authority for this purchase. Authenticity asks whether the merchant's view of the request reflects the user's intent rather than an error or a model hallucination. Accountability asks who is responsible when a transaction goes wrong.
AP2 answers these questions with a role-based architecture in which each party receives only the credentials it needs.
How mandates work
AP2 uses verifiable digital credentials (VDCs), which the documentation describes as tamper-evident, cryptographically signed objects. There are two mandate types, and each exists in an open form, before a cart is final, and a closed form, which authorizes a specific checkout or amount.
| Mandate | Stage | What it records | Shared with |
|---|---|---|---|
| Checkout Mandate | Open | User constraints and goals before a cart is finalized for autonomous execution | Merchant |
| Checkout Mandate | Closed | Authorization of a specific, finalized checkout | Merchant |
| Payment Mandate | Open | Payment constraints such as budget and allowed instruments | Credential provider, networks, merchant payment processor |
| Payment Mandate | Closed | Authorization of a fixed amount bound to a finalized checkout | Credential provider, networks, merchant payment processor |
The documentation states that the mandates are chained together, which provides a verifiable audit trail for both human-present and human-not-present transactions.
Where AP2 fits in the agent stack
AP2 is an extension for A2A and is also integrated with the Universal Commerce Protocol. Developers build agents with the Agent Development Kit (ADK) or another framework, equip them with tools through the Model Context Protocol (MCP), coordinate them through A2A, and use AP2 to secure payments. In this split, MCP covers tool access, A2A covers agent collaboration and AP2 covers payment authorization.
The initial version supports pull payments such as credit and debit cards. The roadmap lists e-wallets, push payments such as real-time bank transfers (the documentation cites UPI and PIX) and digital currencies. The public samples include a human-not-present scenario that uses x402, which shows that the protocol can work with more than one payment method. It does not show production adoption.
What v0.2 changes
Google's April 2026 announcement describes AP2 v0.2 as introducing updates for autonomous transactions, including Human Not Present payments. Its example is an agent that buys a limited-run ticket as soon as it goes on sale, based on pre-authorized user instructions. In practice, the scope written into the open mandate is what limits the agent.
Google also describes Verifiable Intent, an AP2-compatible standard co-developed with Mastercard, which creates a tamper-proof log of user-authorized agent actions. Google says it is also being donated to FIDO. Mastercard presents Verifiable Intent as a trust layer for provable user authorization, consumer protection, accountability and interoperability in agent-led commerce.
Governance: from Google project to FIDO
Google's 28 April 2026 post says AP2 is being transferred to the FIDO Alliance so that it stays platform-agnostic and community-led. The AP2 documentation adds that standardization will continue in FIDO's Agentic Authentication and Payments Technical Working Groups. The FIDO Alliance's own announcement could not be retrieved during this research, so the governance details above rest on Google's and the AP2 project's statements.
What remains open
SignorCrypto analysis:
- Mandates move the question from "did the agent act?" to "what exactly did the user sign?" The answer depends on how constraints such as budget, merchant, instrument and time window are written. Vague mandates create disputes at a different layer.
- An audit trail is not a liability rule. A chain of signed credentials records who authorized what. It does not, by itself, allocate responsibility among issuer, merchant, platform and developer. The AP2 documentation lists accountability among the open questions of the agent economy.
- AP2 v0.2 and the public repository are under active development. The samples demonstrate flows; they do not measure production volumes, merchant adoption or regulatory acceptance, and this article does not claim them.
- In human-not-present flows, mandate design is the main control. A missing expiry, a broad budget or a weak merchant check can authorize more than the user intended.
FAQ
Is AP2 a blockchain protocol? Not by definition. The documentation sets card payments as the initial scope, with e-wallets, bank transfers and digital currencies on the roadmap. The x402 scenario is one sample among several.
Does AP2 replace card networks? None of the sources reviewed says so. The documentation lists networks and the merchant payment processor among the recipients of the Payment Mandate. SignorCrypto's reading is that AP2 is designed to operate alongside existing payment infrastructure, not to bypass it.
Sources
- AP2 documentation: protocol scope, mandate model and roadmap
- Google Cloud: Announcing Agent Payments Protocol (AP2), 16 September 2025
- Google: AP2 v0.2 and the FIDO Alliance donation, 28 April 2026
- Mastercard: How Verifiable Intent builds trust in agentic AI commerce
- AP2 GitHub repository: code samples and changelog
Next step
Teams designing an agent checkout usually have to settle mandate scopes, merchant verification and audit logging before writing integration code. Ask SignorCrypto for a technical review of your mandate architecture before you build.