Verifiable Intent: How Cryptography is Securing the Future of AI-Driven Payments
Sat, May 29 2026 /Mpelembe Media/ — The Rise of Agentic Commerce The digital economy is undergoing a massive shift from human-centric, “click-to-buy” interactions to autonomous “agentic commerce”. AI agents are no longer just conversational assistants; they can now discover products, negotiate prices, manage subscriptions, and execute transactions on a user’s behalf. However, traditional payment rails break down when a human is not present to click a checkout button. This creates a crisis of trust around three core issues: verifying the user’s authorization, ensuring the authenticity of the agent’s actions (guarding against AI hallucinations), and determining accountability in case of disputes.
The Trust & Authorization Layer: AP2 and Verifiable Intent To address this trust gap, a coalition of tech and finance giants have developed open, cryptographic standards:
- The Agent Payments Protocol (AP2): Spearheaded by Google and over 60 partners, AP2 acts as a universal language for secure agent-merchant transactions. It uses a system of “Mandates”—tamper-evident digital contracts (Intent, Cart, and Payment Mandates)—to cryptographically capture a user’s spending boundaries and specific purchase approvals.
- Verifiable Intent (VI): Co-developed by Mastercard and Google, VI serves as the evidence layer for AP2. It uses Selective Disclosure JSON Web Tokens (SD-JWTs) to create an auditable, privacy-preserving chain of trust. This ensures that merchants only see the order details they need, payment networks only see the payment amounts, and sensitive raw data remains secure.
The Execution & Checkout Layer: ACP, MPP, and x402 Alongside authorization protocols, new execution protocols manage how money actually moves between machines:
- Agentic Commerce Protocol (ACP): Co-authored by Stripe and OpenAI, ACP focuses on the merchant checkout experience. It standardizes how an agent browses a catalog, assembles a cart, and completes a purchase using scoped payment tokens, ensuring the merchant remains the seller of record without exposing the buyer’s actual credit card.
- x402: Driven by Coinbase and Cloudflare, x402 revives the dormant HTTP 402 (“Payment Required”) status code to enable stateless, machine-to-machine micropayments. It allows agents to autonomously pay fractions of a cent (using USDC stablecoins on the Base network) for API calls, data queries, or web content without needing pre-registered accounts.
- Machine Payments Protocol (MPP): Developed by Stripe and the Tempo blockchain, MPP sits a layer above x402. It is designed for high-frequency agent billing and supports both fiat (via credit cards) and stablecoins. It allows agents to stream payments or authorize bulk micro-transactions within a single session.
The Ultimate Impact Together, these protocols are building a future where software can safely spend money. By relying on cryptographic proofs instead of inferred AI actions, these standards ensure privacy, PCI-DSS compliance, and non-repudiable audit trails for dispute resolution. They transform “intent” from an implicit assumption into a provable, machine-readable artifact.Beyond the “Buy” Button: How AP2 is Turning AI Agents into Authorized Shoppers
The global e-commerce infrastructure is currently a friction-filled relic of the Web 2.0 era, built on the singular assumption of a human at the keyboard. Our payment systems are designed for the physical act of a person clicking a “Buy” button, requiring real-time biometric scans, CVVs, or multi-factor handshakes. In this world, if a user isn’t present to authorize a transaction, the gears of commerce simply grind to a halt.However, as AI agents evolve from simple chat interfaces into autonomous operators, we are facing a “crisis of the unattended cart.” Imagine an agent attempting to secure a limited-edition sneaker drop or book a volatile airfare deal at 3:00 AM while the user is asleep. Traditional systems have no way to verify if this machine is a legitimate representative of the user or an AI “hallucination” on a spending spree. Without a protocol to bridge this trust gap, the agentic economy cannot scale beyond simple recommendations.To solve this, the Agent Payments Protocol (AP2) was launched in late 2025 as the open-standard companion to the Agentic Web. Developed through a high-impact collaboration between Google and Mastercard—specifically incorporating the Verifiable Intent (VI) evidence layer—AP2 moves us from “inferred actions” to deterministic cryptographic proofs. It provides the foundation for a world where machines don’t just shop, but are fully authorized to settle the bill.
Takeaway 1: Intent is the New Currency (The Mandate Model)
AP2 replaces the binary “buy” action with a structured three-layer chain of Verifiable Digital Credentials (VDCs) known as mandates. This architecture, co-developed with Mastercard, treats user intent as a cryptographic primitive rather than a mere suggestion. By using Decentralized Identifiers (specifically did:wba or Web-Based Agent DIDs), the protocol ensures that identity is portable and not locked into a single platform.
- Intent Mandate (Open): Captures the user’s high-level constraints and goals (e.g., “Find running shoes under $150, size 10”). This is the “Open” stage where the user defines the boundaries for autonomous execution.
- Checkout Mandate (Closed): Formerly referred to in early drafts as the “Cart Mandate,” this credential locks in the specific details—SKUs, pricing, and taxes—once the agent has negotiated a deal with a merchant. It is cryptographically bound to the merchant’s signed checkout object.
- Payment Mandate (Closed): The final credential shared with the payment network. It authorizes the specific amount against a funding instrument, signaling that an agent is involved and providing proof of the user’s original consent.This shift is the only viable defense against AI hallucinations. By moving from a model of “trusting the agent’s reasoning” to “verifying the agent’s mandates,” the protocol ensures that even a compromised agent cannot spend outside its pre-defined bounds. As the documentation states, trust in this era is ” anchored to deterministic, non-repudiable proof of intent ” rather than the black-box logic of a Large Language Model.
Takeaway 2: Shopping While You Sleep (Human-Not-Present Modality)
The true breakthrough of AP2 lies in its “Human-Not-Present” (Autonomous) modality. This contrast to the “Human-Present” (Direct) mode allows for a revolutionary concept of “delegated trust.” In this modality, a user signs an Open Mandate upfront, setting specific budget and merchant constraints. This allows the agent to act as a proxy, monitoring the web for specific conditions—such as a price drop or a product release—and executing the transaction without waking the user for a CVV code.This delegated trust is transformative because it makes commerce asynchronous. The machine operates within a “sandbox of authority,” ensuring it can act with cryptographic certainty while the user is offline.”A consumer sets a rule: ‘Buy the new limited-edition Apollo sneakers from SneakerWorld the moment they are released next Tuesday, as long as the price is under €250.’ The consumer signs a single, detailed Intent Mandate upfront… the agent acts on this pre-authorization, automatically creating the Checkout and Payment Mandates to complete the purchase on the consumer’s behalf.”
Takeaway 3: Privacy by Architecture (The End of Exposed Credentials)
Current “auto-buy” bots often require users to hand over raw credit card credentials or sensitive login data, creating a massive security liability. AP2 introduces Selective Disclosure via the SD-JWT (Selective Disclosure JSON Web Token) format. This ensures that while the Shopping Agent orchestrates the purchase, it never actually sees the raw payment data, maintaining PCI-DSS compliance by design.Each participant in the transaction—Merchant vs. Payment Network—only receives the specific data required to verify their leg of the transaction. For example, a merchant needs to see the specific line items to fulfill the order, but the payment network only needs to know the total amount and the authorized payee.| Data Element | What the Merchant Sees | What the Payment Network Sees || —— | —— | —— || User Identity | Verified Identifier (DID) | Verified Identifier (DID) || Line Items | Full SKU/Price Detail | Hidden (Minimized) || Payment Instrument | Tokenized Reference | Full Payment Details || Transaction Amount | Total Price | Total Price || Constraints | Merchant-specific rules | Payment-specific rules |
Takeaway 4: The Death of Digital Islands (Interoperability)
For agentic commerce to succeed, it must avoid the “walled garden” trap of the current web. AP2 was launched with over 60 partners, including Mastercard, PayPal, and Coinbase, and is currently transitioning to the FIDO Alliance for long-term standardization.Crucially, AP2 is rail-agnostic. While it supports traditional card networks, it is a massive enabler for “Machine Payments” via stablecoins like USDC . By settling in stablecoins, agents can bypass the “interchange tax” of traditional card rails—essential for the micro-transactions and cross-border settlements that define agent-to-agent commerce. This creates a cohesive “Agentic Stack”:
- Model Context Protocol (MCP): Standardizes how an agent connects to data sources and tools.
- Agent-to-Agent (A2A): Standardizes how agents negotiate and discover each other.
- Agent Payments Protocol (AP2): The terminal payments layer that carries the instruction and cryptographic proof of consent.
Takeaway 5: Disputes Become Mathematical (Cryptographic Accountability)
The “he-said, machine-said” problem has long haunted automated commerce. AP2 solves this through a cryptographic audit trail using chained SD-JWTs. Every step of the transaction is recorded in a non-repudiable format, linking identity, intent, and action into a single evidence chain.A critical security guardrail in this architecture is that L3 (the Action Layer) is terminal . This means an agent cannot sub-delegate its authority to another agent. This prevents “agentic cascades” where authority is passed down a chain until it is eventually abused. The verification process follows a strict 3-step mathematical proof:
- Identity: Is the user’s key valid and anchored to a trusted issuer (L1)?
- Intent: Do the constraints in the Intent Mandate (L2) match the user’s signed instruction?
- Action: Does the final checkout (L3) match the signed intent without exceeding budgets or merchant limits?
Conclusion: The Future of the Agentic Web
The arrival of AP2 marks the transition from a platform-centric web to a protocol-centric “Agentic Web.” We are moving away from the era where commerce was a series of closed ecosystems—Amazon, Walmart, or Apple—and toward a world where every node on the network is simultaneously a consumer and a provider.As the payments-layer companion to this shift, AP2 ensures that when we delegate our tasks to autonomous systems, we do not surrender our financial autonomy. By treating intent as a verifiable cryptographic object, we allow agents to operate at machine speed while humans remain in ultimate control.We must now ask ourselves: are we ready for a world where “Connection is Power,” and where our financial security is defined not by our presence at a keyboard, but by the cryptographic mandates we leave behind? The infrastructure is now in place; the “Buy” button is about to become a relic of the past.
