major labsSubscribe
Open data · Mandates

State of Agent Mandates

When an AI agent is authorized to pay, what does the authorization actually look like, who issues it, and how is it revoked? Seven agent-payment rails, documented from their primary specifications: the artifact, the issuer, the revocation mechanism, the bridges to other protocols, the status and the source. This page reports what each specification says. It does not rate, rank or compare the rails.

7
rails documented from primary specs
6
live or piloting
1
spec-only or announced
2026-09-20
rail facts last verified

The discipline, borrowed from the x402 tracker: live and announced are never mixed, every entry carries a primary source, and anything I could not verify firsthand is labeled, not guessed.

Live and piloting

x402

Livex402 Foundation (Linux Foundation)
Artifact: Signed on-chain transfer authorization (EIP-3009 pattern: from, to, value, validity window, nonce)
Issuer: The payer's own wallet key; nobody mints anything
Revocation: Validity window + nonce; on-chain cancel before settlement; no push notification to relying parties.
Bridges: MCP transport (x402 payload rides tool-call metadata); A2A transport; a2a-x402 extension into the AP2 ecosystem
Protocol v2 spec live; production usage on Base; x402 Foundation launched operationally under the Linux Foundation on July 14, 2026 with 40 named members.primary source

Visa Trusted Agent Protocol

PilotVisa (spec open source, built with Cloudflare)
Artifact: Per-request RFC 9421 HTTP message signature; payment behind it is a tokenized Visa credential
Issuer: Agent's own keys, trusted via Visa's Agent Registry; Visa mints the payment tokens
Revocation: Not published. Registry removal fails future verifications; signatures are single-use.
Bridges: Built on RFC 9421 HTTP message signatures, developed with Cloudflare
Spec live October 2025; pilot transactions completed December 2025; OpenAI partnership announced June 10, 2026.primary source

OpenAI / Stripe ACP

LiveOpenAI + Stripe (Apache 2.0, agenticcommerce.dev)
Artifact: PSP-issued scoped bearer token (vault token / Stripe Shared Payment Token) with an allowance: max amount, currency, merchant, expiry, single use
Issuer: The payment service provider, after buyer confirmation in the checkout UI
Revocation: Revocable at any time by the issuer; sellers are notified by webhook.
Bridges: PayPal processes ACP tokens as Braintree nonces; merchants expose checkout as an MCP tool
Specification maintained by OpenAI and Stripe as founding maintainers, latest dated version 2026-04-17, repository marked Beta; PayPal's Agent Ready documents ACP support. OpenAI discontinued the initial version of Instant Checkout in ChatGPT on March 24, 2026 and moved to merchants running their own checkout (source: openai.com/index/powering-product-discovery-in-chatgpt)..primary source

PayPal Agent Ready

LivePayPal / Braintree
Artifact: Other rails' tokens processed through Braintree: ACP delegated payment tokens, and single-use Google Pay tokens via the Google Pay payment handler under UCP; PayPal wallet authorization on native flows
Issuer: Whoever the surface designates: the PSP under ACP, Google Pay under UCP, PayPal's wallet natively
Revocation: Single-use tokens expire or are consumed; wallet-level standing-permission revocation unpublished.
Bridges: Accepts ACP and UCP artifacts through one integration
Perplexity Instant Buy live November 2025; ChatGPT rollout 2026; Hey Savi UK launch June 2026.primary source

Google UCP (standalone)

LiveUCP Tech Council (Google, Shopify, Etsy, Target, Wayfair; Amazon, Meta, Microsoft, Salesforce and Stripe joined April 24, 2026)
Artifact: Encrypted single-use Google Pay token; the business profile publishes verification keys as a JWK Set in keys[] (the separate signing_keys[] field was removed in v2026-08-25)
Issuer: Google Pay
Revocation: Single-use.
Bridges: AP2 Checkout Mandates wrap the UCP Checkout object by spec
Live on AI Mode in Google Search and Gemini web (app listed as coming soon); spec release v2026-08-25 adds Food and Lodging verticals, 3DS2 payment authentication and response-carried request constraints, and moves the AP2 mandates extension into a common payment namespace.primary source

MCP (core protocol)

LiveModel Context Protocol a Series of LF Projects, LLC (Linux Foundation)
Artifact: OAuth 2.1 access token, scope-limited and audience-bound; payment credentials explicitly pushed out-of-band
Issuer: The MCP server's chosen OAuth authorization server
Revocation: Standard OAuth: short-lived tokens, mandatory refresh rotation for public clients.
Bridges: Carries x402 payloads in tool-call metadata; ACP checkout exposed as MCP tools; AP2 integrates alongside A2A
Current protocol version is 2026-07-28; its authorization spec adds RFC 9207 issuer validation and deprecates Dynamic Client Registration in favor of Client ID Metadata Documents; no payment mandate primitive in core.primary source

Spec-only and announced

Kept strictly separate from the live list.

Google AP2

Spec-onlyGoogle + 60 launch partners
Artifact: Checkout + Payment Mandates: SD-JWT verifiable credentials, hash-bound to the merchant-signed cart
Issuer: The user, signing on a non-agentic Trusted Surface. In autonomous (human-not-present) mode the user signs open Mandates and the Shopping Agent's key signs the closed Mandates.
Revocation: Expiry-first: short exp claims, one-outstanding-mandate rule, signed receipts. No status list yet.
Bridges: Wraps UCP (the Checkout Mandate's checkout_jwt MUST be the UCP Checkout object); user anchor is an EMVCo digital payment credential; a2a-x402 bridges to x402
v0.2 spec public; no card network accepts AP2 mandates in live authorization yet.primary source

The bridge map

Documented links between the specifications:

AP2 ↔ UCPAP2 Checkout Mandates are hash-bound to the UCP Checkout object by spec.
AP2 ↔ EMVCoAP2's worked example uses an EMVCo digital payment credential as the user's trust anchor.
x402 ↔ MCP / A2Ax402 publishes transports for MCP (payload in tool-call metadata) and A2A (the a2a-x402 extension).
ACP ↔ PayPal / MetaThe Apache 2.0 spec has been adopted beyond its authors; PayPal processes ACP tokens through Braintree.

Related open-source work

MandateKit is my open-source library for signing and verifying a mandate as a self-contained object, in Python or TypeScript. It is v0 and experimental.

mandatekit on GitHub →

Changelog

  • 2026-09-20Re-verification pass against primary sources. MCP: the current protocol version is 2026-07-28 and the project sits under the Linux Foundation as Model Context Protocol a Series of LF Projects, LLC; the row previously cited the 2025-11-25 authorization spec and listed Anthropic / MCP project as steward. UCP: governed by a Tech Council since April 24, 2026; the row previously listed Google alone as steward, and it now records spec release v2026-08-25 and the keys[] change to the business profile. The earlier note that Klarna and Affirm are embedded via Google Pay was not re-verified and is removed. ACP: the status note said Instant Checkout was live in ChatGPT for US users; OpenAI discontinued the initial version of Instant Checkout on March 24, 2026, and the note now says so and records the latest dated spec version, 2026-04-17. The ACP status value and revocation field are unchanged pending review. AP2: the status date moves to the v0.2.0 release of April 28, 2026 and the issuer field now covers human-not-present mode. PayPal Agent Ready: artifact wording aligned to PayPal's documentation; its status note was not re-verified at a PayPal source and is unchanged. Rows not named here were not changed in this pass; x402 was verified on 2026-09-18.
  • 2026-09-18Converted to a factual matrix. The three-way labels, the summary count and the finding paragraph are removed; each rail now lists its artifact, issuer, revocation, bridges, status and primary source only. The x402 row now records the Foundation's July 14, 2026 operational launch. The other rows were last verified on 2026-06-12 and a full re-verification pass is pending.
  • 2026-06-12Tracker launched: seven rails documented from primary specs.

Related