---
title: "Cryptographic Mandates and AP2: The New Evidence Layer"
slug: "cryptographic-mandates-ap2"
description: "Traditional online payment systems are built around human browser sessions, creating severe liability and authorisation gaps when autonomous non-human agents execute transactions asynchronously."
category: "payments"
schemaType: "TechArticle"
readingTimeMin: 4
relatedTaxonomy: ""
relatedValue: ""
provenance: "human_written"
authorName: "Ben McIntyre"
datePublished: "2026-08-04T12:09:12.366Z"
dateModified: "2026-08-05T13:23:22.370Z"
canonicalUrl: "https://theagentgateway.com/articles/cryptographic-mandates-ap2"
---
# **Cryptographic Mandates and AP2: The New Evidence Layer**

> **Executive TL;DR:**
> - Legacy payment rails designed for human browsers create liability gaps when autonomous non-human agents execute transactions asynchronously.
> - The Agent Payments Protocol (AP2) partitions the payment lifecycle into three non-repudiable Mandates secured by W3C Verifiable Credentials.
> - This multi-layered trust model separates cognitive planning from execution custody to insulate platforms from unmanaged spending and hallucinations.

---

## How Does the AP2 Protocol Partition Agent Payment Authority?

The Agent Payments Protocol (AP2), governed by the FIDO Alliance, is an open, platform-agnostic trust and evidence protocol designed to authorise and secure autonomous machine-to-machine financial transactions. It replaces human checkout interactions with cryptographically signed contracts, providing an immutable audit trail to prove a human principal explicitly authorised a machine's financial action.

* **Intent Mandate:** A cryptographically signed digital contract generated by the human user that captures strict spending limits, temporal validity windows, and allowed merchant boundaries to constrain agent behaviour.  
* **Cart Mandate:** A structured data payload generated by the merchant or remote agent that binds the exact items, quantities, and negotiated pricing directly to the user's initial intent.  
* **Payment Mandate:** The final condensed authorisation linked securely to the Cart Mandate and a scoped funding instrument, which is submitted to the payment network to execute settlement without exposing raw credentials.

## How to Implement AP2 Mandate Schemas with Drizzle ORM

To implement AP2 compliance within a Next.js and Supabase backend, developers must enforce strict schema definitions and custody policies. The Drizzle ORM schema must store these mandates as secure, structured JSONB payloads within an append-only transaction ledger, utilising Row Level Security (RLS) to restrict credential exfiltration risks.

```
import { pgTable, uuid, text, timestamp, jsonb, pgEnum } from "drizzle-orm/pg-core";

// Core enums for the Agent Gateway Database Architecture
export const paymentProtocolEnum = pgEnum("payment_protocol", ["x402", "L402", "Stripe ACP", "AP2", "NONE"]);
export const complianceTierEnum = pgEnum("compliance_tier", ["Unverified", "Tier 1 - Signed Wallet", "Tier 2 - KYC Cleared"]);

// Relational ledger table for tracking verified agent approvals and FIDO-compliant AP2 mandates
export const agentApprovals = pgTable("agent_approvals", {
  id: uuid("id").defaultRandom().primaryKey(),
  agentId: uuid("agent_id").notNull(),
  approvalHash: text("approval_hash").notNull(),
  manifestData: jsonb("manifest_data").notNull(), // Stores the W3C Verifiable Credential data (Intent, Cart, Payment Mandates)
  createdAt: timestamp("created_at").defaultNow().notNull(),
});

// JSON-LD Schema Payload representing a non-repudiable AP2 Payment Mandate Credential
export const sampleAP2MandatePayload = {
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://fidoalliance.org/contexts/ap2/v1"
  ],
  "id": "urn:uuid:6c8bc822-ea1c-4b6b-8012-70b13d2f3479",
  "type": ["VerifiableCredential", "AgentPaymentMandate"],
  "issuer": "did:key:z6MkuT7pGq86Hn7...",
  "issuanceDate": "2026-08-04T00:29:52Z",
  "credentialSubject": {
    "intent_mandate": {
      "user_did": "did:key:z6MkuT7...",
      "max_spend_limit": { "amount": "150.00", "currency": "USD" },
      "expiration": "2026-09-01T00:00:00Z"
    },
    "cart_mandate": {
      "merchant_id": "merch_global_fashion_110",
      "items_hash": "sha256-8a9d1b...",
      "items": [
        { "sku": "head_091a", "price": "89.99", "quantity": 1 }
      ],
      "total_value": 89.99
    },
    "payment_mandate": {
      "linked_cart_hash": "sha256-8a9d1b...",
      "funding_token": "tok_spt_991823"
    }
  },
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2026-08-04T00:29:52Z",
    "proofValue": "z58DjdK92LmQxP..."
  }
};
```

| Feature Parameter | AP2 (Agent Payments Protocol) | x402 Micropayment Protocol |
| ----- | ----- | ----- |
| **Primary Function** | Delegated commercial authorisation and non-repudiation | Programmatic stablecoin micropayments for web resources |
| **Evidence Structure** | Cryptographic W3C Verifiable Credentials (Intent, Cart, and Payment Mandates) | Base64-encoded EIP-3009 signed payment headers over HTTP 402 |
| **Execution Latency** | Variable; bound to human-in-the-loop review loops and card processing windows | Sub-2-second near-instantaneous on-chain finalization (Base/Solana L2) |
| **Economic Fit** | Medium-to-high value retail and B2B procurement transactions | High-frequency, sub-cent machine-to-machine API and tool queries |

## Which Verified Agents Generate AP2-Signed Mandates?

To explore production-grade AI agents that natively support the AP2 protocol and generate cryptographically signed mandates, browse our verified enterprise directory. Every listed agent has been rigorously audited by the Agent Gateway's automated Grader to verify signature authenticity, ensure strict adherence to W3C Verifiable Credential specifications, and guarantee full compatibility with major enterprise walled gardens.

[Browse all AP2-compatible agents in the directory →](/agents?protocol=AP2)

## Common AP2 Architecture Questions Answered

* **Q: How does the AP2 protocol resolve the liability gap when a Level 3 autonomous agent must complete a checkout asynchronously without a human present?**  
  * **A:** In human-not-present scenarios, AP2 relies on a pre-authorised, cryptographically signed Intent Mandate that defines strict boundaries such as spending limits and temporal validity windows. Before execution, the merchant or remote agent must bind the exact inventory and price details into an Autonomous Cart Mandate. The Gateway then verifies these compiled credentials do not violate the user's locked constraints before generating the final Payment Mandate, ensuring full non-repudiation and clear liability attribution.  
* **Q: How can an enterprise protect its data from leakage and exfiltration when routing sensitive payload metadata through the inline Translation LLM during AP2 negotiation?**  
  * **A:** To prevent PII and proprietary context exposure, the Gateway enforces a strict Data Transfer Object (DTO) boundary that scrubs raw content and unmasked identifiers before public visibility. Payloads passing through the inline Translation LLM are processed within stateless, enterprise-tier APIs that guarantee Zero Data Retention (ZDR) and prohibit training. Next.js Edge Functions run an edge-based pre-processor that programmatically anonymises sensitive keys via Zod sanitisation prior to LLM mapping.