How do we know an AI agent is allowed to spend this money on someone’s behalf? We need more than a system that recognizes the agent: we need evidence connecting the person or organization that delegated authority, the agent that acted, the limits of that authority, the specific checkout and payment, and a record that can be checked later. Current approaches divide this work across identity, authorization, payment execution and receipts; none of the frameworks covered here establishes one legally settled record for every payment method and jurisdiction.
What a binding record needs to connect
A useful binding record is an evidence chain, not simply an agent ID or a payment approval. It lets a merchant or later reviewer ask: who acted, who granted authority, what was permitted, which purchase used that permission, and what happened when payment was attempted?
- Delegator: the person or organization on whose behalf the agent acts.
- Agent and identity context: the software acting, with any relevant consumer or device identity information.
- Authority: the user-approved instruction and its scope, such as a task or constraints.
- Checkout and payment: the purchase to which the authority applies and the actors that validate and execute payment.
- Evidence: records that allow the authorization, checkout and payment to be checked after the event.
Mastercard frames the related questions as “Who is acting?”, “What was authorized?” and “What is the agent allowed to do?” Its September 30, 2026 framework groups the work into five pillars: identity, intent, controls, trusted execution and intelligence. Those pillars are a framework for organizing the problem, not an independently validated measurement model or a complete technical protocol.
How the evidence chain works
1. Establish which agent is acting
Visa’s Trusted Agent Protocol describes a signed agent-recognition message and an identity object that links the interaction to consumer or device data. A merchant can retrieve public keys and verify the signature. The specification names fields including the target authority and path, creation and expiry timestamps, key identifier, signature algorithm, a tag indicating browser or payer authentication, and a nonce.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Visa says the creation and expiry times should be no more than eight minutes apart, and describes replay protection through tracking recent nonces. These are protocol-specific provisions, not universal rules for all agent payments. Most importantly, successful agent recognition answers an identity question; by itself it does not show that a user authorized the purchase.
2. Establish what the user authorized
Google’s Agent Payments Protocol (AP2) separates delegation from authorization for a particular action. During delegation, the agent presents mandate content on a trusted surface, the user approves it, and the resulting mandate is returned to the agent. Later, when a verifier asks for proof, the agent presents a relevant mandate. The verifier checks its integrity and whether the requested action fits the mandate’s content.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This distinction matters when an agent has continuing or task-based authority: being recognized as the same agent on a later visit does not establish that a new action falls within the permission the user granted. The verifier needs to evaluate the relevant mandate, not infer permission from identity alone.
3. Tie authority to the actual checkout and payment
AP2 defines Checkout and Payment Mandates to connect authorization with purchase execution. A Checkout Mandate is intended to give the merchant cryptographic evidence that the agent may purchase the assembled checkout. The merchant verifies the mandate and checkout hash. If the mandate is open-ended, the merchant also checks its constraints against the final checkout.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Payment validation is split among different actors. Credential providers and payment networks verify the Payment Mandate before returning payment credentials; the merchant’s payment processor checks that the credential is scoped to the checkout. This separation helps explain why “the payment went through” and “the agent was authorized to make this exact purchase” are distinct questions.
4. Preserve evidence for later review
AP2 specifies checkout and payment receipts and describes checks for disputes, including validating mandate integrity and matching references to mandate hashes. That makes receipts and linked hashes useful for tracing an authorization to the checkout and payment evidence. The protocol’s verification steps can support review of what was authorized and accepted, but they do not, on their own, determine who bears legal liability in every case.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the approaches differ
The following comparison reflects what the named sources describe; it does not imply that the approaches have equal scope or that any one is a universal standard.
| Approach | Identity | User intent and purchase scope | Execution and audit evidence | Status or qualification |
|---|---|---|---|---|
| Visa Trusted Agent Protocol | Signed agent recognition linked to consumer or device identity data. | The cited specification describes agent recognition; transaction authorization and checkout binding are not stated in the cited material. | Merchants can verify signatures using public keys; timestamp and nonce provisions address message validity and replay. | Visa protocol-specific guidance; the cited material does not establish a universal payment rule. |
| Google AP2 | Mandates identify delegated authority and connect it to an action; the cited material does not state a general agent-identity scheme comparable to Visa’s. | User-approved mandates can be checked against an action; a Checkout Mandate binds authority to an assembled checkout, with constraints checked against the final checkout. | Credential providers, networks, merchants and payment processors have separate verification roles; checkout and payment receipts support later checks. | A protocol specification; it does not settle legal liability across jurisdictions. |
| Mastercard five-pillar framework | Identity is one of five pillars. | Intent and controls are separate pillars. | Trusted execution and intelligence complete the five pillars; further protocol-level verification details are not stated in the cited framework description. | Mastercard framework announced September 30, 2026; it is not an independently validated measurement model. |
What a binding record can—and cannot—show
A well-linked record can make it possible to test whether a recognized agent presented valid delegated authority, whether the authority covered the checkout, and whether payment actors processed credentials scoped to that checkout. That is stronger than relying on an agent label or a successful payment alone.
Recommended Free Tools
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
It cannot make consent self-evident in every circumstance or settle every dispute automatically. The International Monetary Fund identifies traceability, consent and liability as open issues, particularly when mandate-based systems allow payments without a separate transaction-level instruction for every purchase. The applicable law, payment arrangement and facts of a dispute still matter.
Why this is still developing
On April 28, 2026, the FIDO Alliance announced collaborative standards work involving AP2. Its announcement described a process in which contributions would be reviewed and developed through the Alliance’s standards process; it did not declare a finished, universally adopted standard. Mastercard’s five-pillar framework is also a named framework rather than evidence of cross-industry adoption.
Accordingly, identity protocols, mandate formats, payment checks and legal allocation of responsibility should be treated as related but distinct layers. The sources described here do not establish a single record format that applies to every payment rail, merchant or jurisdiction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
