When we started nekuda, our core mental model for agents was they are a form of delegation. That’s very different from how software is usually used today - most software works as an extension of what you already do. With agents, the model shifts: over time they can take a task end-to-end.
That task might be small, like changing a variable type in a codebase. Medium - like researching a topic. Or heavy, like organizing your kid’s birthday party, including making reservations and negotiating with suppliers.
In all these cases, a human delegates a task using voice or free text instructions.
We then applied Jeff Bezos’s exercise: imagine the future and ask, what won’t change? This is tough, because in a fast-moving technological shift almost everything will change. But one thing we can be confident in, is that humans won’t change quickly. Evolution, unlike technology, takes millions of years. So it’s safe to assume that humans in 5 or 10 years will be pretty much the same in nature.
And what do humans do?
They make mistakes.
Humans make all sorts of mistakes. Communication isn’t as clear as we think it is, mutual understanding of concepts drifts, or things just get lost in translation.
And what else do humans do?
They cheat. People bend the rules all the time.
So mistakes and fraud (cheating in fintech lingo) will likely stay with us for decades.
When we applied this lens to agents, we realized something important: if agents are to be trusted, especially in commerce and payments, we need systematic ways to handle mistakes and fraud. That became a core part of how we think about agentic systems at nekuda.
We wrote back in April this year a blog post called Why AI Agents Break the Old Rules of Payments:
“Authorization in payments has traditionally been straightforward - users explicitly confirm intent by actions like clicking "Buy." However, with the rise of AI-powered agents capable of autonomously executing purchases based on natural language instructions, explicit user intent becomes less clear, creating new risks such as unintended purchases and friendly fraud…Standardizing Mandate formats and protocols is essential for widespread adoption of agentic payments.”
All roads lead to mandates
If agents are going to make mistakes because of human error (we’re assuming agent-error will shrink to near zero over time), and humans will keep cheating, then we need to make sure every payment operation is backed by a recorded human authorization.
This helps in several ways:
Creates accountability for human action
Closes the trust gap between a merchant who has to fulfill an order and the agent that placed it
Provides a historical record for disputes down the road
Gives stakeholders (like card networks in credit card payments) proof that the action was authorized
The list goes on, but the bottom line is clear: we’ll need large, immutable systems that track these authorizations and make them available to relevant stakeholders – card networks, issuers, stablecoin providers, and others depending on the form of payment.
We’re now entering a phase of the market where most big players understand this. Everyone is working to standardize some version of the mandate/authorization problem.
Google’s AP2 efforts tackle similar issues. Lets begin with a short intro. We approached this post from a first principles perspective instead of diving into specs.
Google AP2
The Agent Payments Protocol (AP2) is an open standard designed by Google to enable secure and reliable payments by AI agents. It addresses the challenge of the verifying that an agent's actions are truly authorized by a human user, not the result of an error or "hallucination.”.
It deals with two scenarios:
Human present – the human is there at the moment of purchase (e.g., telling the agent to buy some specific shoes from Nike).
Human not present – the human gives an instruction for the agent to act later (e.g., “buy concert tickets when they go on sale”).
In both cases, the protocol tries to make sure the human actually authorized the transaction.
It uses Verifiable Digital Credentials (VDCs), which serve as cryptographic mandates proving a user’s intent. The types are:
Intent Mandate – captures a user’s broad instruction for a purchase, like “buy tickets when they go on sale.” Used in human-not-present scenarios.
Cart Mandate – captures the user's final, explicit authorization for a specific cart, including the exact items and price, in "human-present" scenarios. This is first being created by a merchant to represent an order (items, price etc.), signed by the merchant, and then sent to the agent for a signature (the end-user ‘seals’ the cart mandate with his signature).
So the basic idea is that when a user approves the agent to make a purchase, it will always be accompanied with some mandate object signed by the user (either Intent or Cart).
Then there is an additional object you can share with other stakeholders like card networks to provide details about the transaction which is called a payment mandate.
Payment Mandate – a separate credential that gives payment networks and issuers visibility into the agentic nature of a transaction, helping them assess risk (e.g. was human present or not present).
This framework ensures that every payment is linked to a verifiable human authorization and creating a clear audit trail.
We generally agree very much with all these concepts above: there should be clear mandates objects distributed to stake holders in the payment process to close the trust gap we mentioned above. The hard part will be adoption and implementation. You could argue the best path is to start with a single, simple form of mandate - without too many opinionated workflows - and build from there. Jumping straight into multiple mandate types could be challenging, because coordinating them across something as complex as the commerce and payments supply chain can be hard.
To implement this type of a standard, we’ll need two things: reliable key repositories for both merchants and agents, and a shared consensus on who the trusted sources are to issue and verify those keys. Without that, mandates don’t mean much.
The good news is we’re already seeing early standards take shape, driven by card networks, cybersecurity firms, and big tech. These groups are all circling the same problem from different angles, trying to lock down the infrastructure that will anchor trust in agentic payments.
All roads lead to standard fragmentation
Another challenge with mandate standards is that every big player wants their version to win. If you’re a powerful company, you’re not going to just endorse someone else’s framework when you have a shot at dictating your own.
That dynamic almost always leads to fragmentation – multiple competing versions of the same concept, each backed by a different heavyweight. We expect exactly this over the next few years.
And that’s not necessarily bad. Fragmentation means the biggest players are taking agentic commerce and payments seriously enough to stake out their version of the future. It’s a sign of energy and momentum in the space.
Thanks for reading!
If you want to dig deeper into how mandates are being implemented in todays agentic commerce world, or have questions on building best-in-class authorization flows for payments, reach out at [email protected].