Verifying the Machine: The Infrastructure of Agentic Trust.

Return once more to the Amalfi Coast. In the third article, the trip went wrong in a specific way: not because anyone stole the consumer's identity, but because the agent, transacting in the consumer's name and on the consumer's own instructions, booked the wrong hotel in the wrong region. The transaction was authorized. It was also a mistake. And the law, as we saw, is not particularly well equipped to sort out who absorbs that loss once the charge has cleared.

The infrastructure now being built by the major payment networks is, in large part, an attempt to keep that scenario out of a courtroom altogether (and, before that, to establish who is even transacting in the first place). It does so not by making agents smarter, but by making the chain of authorization itself verifiable, proving that a real agent is present, that its request matches what the consumer actually asked for, and that the money it can move is scoped in advance, at every step and by every party in the transaction.

Three Companies, One Problem

Visa's Trusted Agent Protocol (TAP), Google's Agent Payments Protocol (AP2), and Mastercard's Verifiable Intent/Agent Pay were all introduced within months of each other, and it is tempting to treat them as competing versions of the same idea. They are better understood as addressing different pieces of the same challenge. TAP is largely about telling a legitimate agent apart from a scraper or a malicious bot at the merchant's front door. AP2 is about capturing and proving what the consumer actually asked the agent to do. Verifiable Intent, which Mastercard built together with Google, aligns with AP2 and packages that authorization into a tamper-resistant credential that an issuer or a merchant can check independently. Agent Pay is about the credential itself, that is, making sure the payment method the agent presents is scoped to exactly what it was authorized to spend, and nothing more.

Put together, they attempt to answer the questions the last article left hanging: is this really an agent acting for a real person, did the agent's request match that person's actual intent, and can the transaction move without exposing the account to more risk than the consumer agreed to? Let's deep dive into these infrastructures.

How Google Uses Mandates to Verify Credentials

Google's AP2 centers on what it calls a mandate: a tamper-proof, cryptographically signed digital contract that captures the terms a consumer actually agreed to before an agent acts, and that any party downstream (the merchant, the issuer, the network) can check against what the agent is now asking to do. The AP2 addresses two primary ways a user may shop with an agent:

1. A real-time purchase (with a human present), where the user's request is first captured in an Intent Mandate and, after the agent presents a cart with what the user wants to buy, the user personally approves and signs a Cart Mandate. According to Google, this is the step that creates a secure, unchangeable record of the exact items and price, so a human can confirm the match before the charge goes through.
2. A delegated task (with no human present), where the user signs a detailed Intent Mandate upfront, specifying the rules of engagement, including price, timing, and other conditions, which serve as limits set to the agent. That Intent Mandate serves as verifiable, pre-authorized proof that allows the agent to automatically generate a Cart Mandate on the user’s behalf once those precise conditions are met.

In both scenarios, Google's goal is to ensure that this “complete sequence - from intent, to cart, to payment - creates a non-repudiable audit trail that answers the critical questions of authorization and authenticity, providing a clear foundation for accountability”. The delegated-task scenario is where this matters most, because it is the one that mirrors the Amalfi booking: no human is present at the moment of purchase, and the agent generates the Cart Mandate on its own. If the structure functions as intended, it would have caught the wrong booking before it happened - the auto-generated Cart Mandate would not have matched the Intent Mandate's constraints, and that mismatch itself becomes the trigger for a human check, rather than something the consumer discovers after the charge clears.

Visa: Telling the Agent from the Bot

Among other things, Visa's TAP addresses an earlier and more basic problem: most merchant websites were never built to distinguish a legitimate shopping agent from a scraper, a scalper bot, or a fraud script hitting the same checkout endpoint. TAP is built on top of existing web infrastructure and lets an agent present a verifiable signal of its own identity and that it is a trusted agent acting on a consumer's behalf, so a merchant can allow it through the same door it would otherwise close to automated traffic. According to Visa, “recognizing trusted agents allows merchants to engage with the same customers coming through a different medium to streamline and enhance these agent interactions”.

This matters more than it sounds like it should. Every one of the legal questions in the earlier articles (agency, apparent authority, ratification) assumes the merchant is dealing with something it can identify as an agent in the first place. Before the law can ask whether the agent had authority, the system has to be able to tell that an agent is there.

Scoping the Money: Mastercard's Agent Pay

Mastercard ships two complementary pieces. Agent Pay works on the credential side of the transaction: rather than handing an agent the consumer's card number, it issues what Mastercard calls Agentic Tokens, an extension of its existing tokenization infrastructure (the Mastercard Digital Enablement Service). The token is scoped to the specific agentic transaction it was issued for. The issuer does not need to trust the agent generally; it only needs to trust that this particular token cannot do more than what the consumer authorized when it was issued.

Verifiable Intent, introduced in March 2026 and co-developed with Google, is the evidentiary layer that sits alongside the token. Rather than simply moving money, it creates what Mastercard describes as a tamper-resistant record of what a user authorized when an agent acts on their behalf, so that if something goes wrong, “everyone needs facts, not guesswork,” in the words of Pablo Fourez, Mastercard's Chief Digital Officer. In practice, that means a signed credential travels with the transaction, encoding the consumer's identity, the instructions given to the agent, and the outcome, so an issuer or a merchant can verify the chain independently rather than taking the agent's word for it.

That design does something the tort and agency doctrines discussed in the third article cannot always do on their own: it limits the size of the loss before it happens, rather than asking a court to allocate it afterward.

A New Layer of Economic Identity

Read together, TAP, AP2, Verifiable Intent, and Agent Pay are not simply adding a new authentication step to an existing system, the way a PIN or a one-time code was added to a card swipe. They are building something closer to a new layer of economic identity infrastructure: a way of attaching a verifiable identity, a defined scope of authority, and an auditable trail of intent to an actor that is not human, so that the rest of the financial system can decide, transaction by transaction, whether to trust it.

Every prior expansion of commerce required something similar, and the pattern is consistent: each time commerce moved further from a human physically present with a card, a new layer was invented to re-anchor the transaction to a real person's intent. The signature (physical or electronic) proved that a human intended to be bound, and this is recognized by courts and laws in most cases. The PIN proved the person presenting the card was the person who held it. Two-factor authentication proved that possession of the card was not enough on its own. Each of those methods, though, was ultimately anchored to a human being. Verifying a cryptographic key and verifying the human behind it are different problems, and the people building the underlying identity standards say so directly. A report prepared for the OpenID Foundation by Tobin South, in collaboration with Stanford's Loyal Agents Initiative, describes AP2's Mandate mechanism in detail and still identifies establishing who or what an agent is as the most fundamental open problem in agent identity: today, an agent's identity is often reducible to a bare client ID, with no robust, portable way to verify the human standing behind it.

Agentic commerce follows the same historical pattern of building a new authentication layer for each new mode of commerce. It is also the first layer where the thing being verified is not a person presenting a card, but software claiming to act for one, which is exactly the gap that current agent-identity standards have not yet closed.

From Impersonation to Delegation: What the Law Will Need to See

These cryptographic layers are not just technical conveniences, but they are rapidly becoming legal and regulatory necessities. For too long, software assistants have accessed systems by essentially “pretending” to be the human user - logging into APIs or websites using the customer's credentials. In the eyes of the law, this "user impersonation" creates a dangerous accountability black hole. If an agent makes a mistake or gets compromised, there is no clean audit trail to prove whether it was the machine or the human who initiated the action.

The consensus among global digital identity standards organizations, such as the OpenID Foundation (page 18), is that impersonation must be replaced by delegated authority. Under this model, an agent never hides behind your identity. Instead, it carries a digital token that explicitly stamps every transaction with two distinct identities: the human who granted the authority and the specific software agent acting.

Regulators are already moving on a related but narrower front. The European Union's AI Act imposes transparency obligations under Article 50, taking force on August 2, 2026, that require people to be told when they are interacting with an AI system and require AI-generated content to be labeled as such. Those rules speak to human-facing disclosure, not to how an agent authenticates itself to a merchant or a bank. That gap is right what payment networks are filling on their own initiative, and it is a preview of where regulation is likely headed next: if the law already insists that a person know when AI is involved, it is a short step to insisting that a transaction be able to prove, cryptographically, which party (human or agent) actually acted.

In the end, payment networks that replace logins with delegated signatures end up building something more useful than account protection: a record that regulators and courts can actually rely on. It ensures that if a transaction ever ends up in a dispute, the question is no longer a guessing game of “who did what”, but a clear, mathematical verification of whether the machine stayed within the boundaries its human master set.

Conclusion

The three previous articles in this series discussed whether a consumer meaningfully consents to what an agent does on their behalf, who absorbs the loss when the agent gets it wrong, and how a market built for human buyers adapts to one that increasingly is not. This article suggests where the industry's answer is heading, at least for now: verify the agent, verify the intent, and scope the money to match. Whether that is enough will not be decided by the protocols themselves. It will also be decided by whether courts and regulators treat a cryptographic mandate the way they already treat a signature.

The future of agentic commerce may ultimately depend on whether digital markets can verify not only payment credentials but machine authority itself. That question is not fully answered by these technologies, but what we've seen so far is the market's first attempt at an answer. It is the one this series leaves open for the law to catch up to.

This article is for informational purposes only and does not constitute legal advice. Reading this essay does not create an attorney-client relationship.