# AP2 Mandate: What It Is and What It Proves

> What an AP2 mandate is, the difference between the checkout and payment mandates, what an open mandate can limit and what a store checks before charging.

URL: https://clione.ai/glossary/ap2-mandate/
Lang: en

If you run a store, the word "mandate" may sound like a direct debit authorization: the signed permission a customer gives so you can pull a payment from their bank account. **An [AP2 (Agent Payments Protocol)](/glossary/ap2/) mandate is something else, though the idea is similar**: a signed authorization that someone can show later. Here the one using it is an [AI agent](/glossary/ai-agent/) buying for a person, in what is called [agentic commerce](/glossary/agentic-commerce/), and what it proves is that the person approved that cart and that payment. It matters to the store because it is the proof it has to check before charging, and the one that gets examined if the charge is disputed.

## How it works

Google introduced mandates in September 2025 as tamper-proof, cryptographically signed digital contracts that serve as **verifiable proof of a person's instructions**. That announcement talked about three: an intent mandate, which captures what the person asks for; a cart mandate, which fixes the exact items and price; and a payment mandate, which ties the payment method to that cart.[^google-ap2-launch]

The current specification, v0.2, works with two:[^ap2-spec]

- **The checkout mandate** gives the store cryptographic proof that the [shopping agent](/glossary/shopping-agent/) is authorized to buy the order it put together.
- **The payment mandate** gives that proof to the store's credential provider, network and payment processor: the agent is authorized to pay for that specific order.

Each exists in two states. **Open**, when it holds the conditions the person sets before an order exists; **closed**, when it authorizes a specific transaction.[^ap2-site] Mandates are issued as SD-JWT, a credential format that lets you reveal only part of the data, and each one declares its type and version in a `vct` field, such as `mandate.checkout.open.1`. The specification asks whoever processes them to compare that exact string, version suffix included.[^ap2-spec]

### Who signs each one

It depends on whether the person is present.[^ap2-flows]

| Situation                           | What the person signs                                                          | What the agent signs                                             |
| ----------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------- |
| Person present (_Human Present_)    | Both closed mandates, on a trusted surface, for example with their fingerprint | Nothing: it prepares the content and brings it over for approval |
| Person absent (_Human Not Present_) | Both open mandates, with their conditions, before leaving                      | The closed mandates, with its own key, within those conditions   |

The trusted surface is the screen where the person gives their consent, and **the specification requires that it not be agentic**: the agent itself cannot be the one that asks for and grants the permission. An open mandate also carries the agent's public key, so only that agent can use it.[^ap2-spec]

### How they are tied to the order

The store signs the order (a checkout JWT). The checkout mandate is bound to that order through a cryptographic hash, and the payment mandate is bound to the same order with the same hash.[^ap2-spec] The practical result: **a mandate signed for one cart is no good for another**. If the agent swaps an item, the hash stops matching.

## What an open mandate can limit

The conditions of an open mandate are constraints with names of their own. The checkout mandate has two:[^ap2-checkout-mandate]

| Constraint                   | What it sets                                                        |
| ---------------------------- | ------------------------------------------------------------------- |
| `checkout.allowed_merchants` | The stores the mandate can be used with                             |
| `checkout.line_items`        | Which items are acceptable for each order line and in what quantity |

The payment mandate's cover money and time:[^ap2-payment-mandate]

| Constraint                            | What it sets                                                       |
| ------------------------------------- | ------------------------------------------------------------------ |
| `payment.amount_range`                | The range the final amount has to fall in                          |
| `payment.budget`                      | The maximum total spend when the agent can reuse the mandate       |
| `payment.agent_recurrence`            | The conditions for the agent to use the same mandate several times |
| `payment.allowed_payees`              | Who can be paid                                                    |
| `payment.allowed_payment_instruments` | With which payment methods                                         |
| `payment.execution_date`              | The time window in which the payment can be executed               |
| `payment.reference`                   | The specific checkout mandate the payment is tied to               |

A closed payment mandate, by contrast, no longer talks about conditions but about facts: the transaction identifier (the order's hash), who is being paid, the amount with its currency as an ISO 4217 code and the payment method used.[^ap2-payment-mandate]

## In a store

A **fictional example**: a customer asks her agent to buy two packs of sencha tea at Example Tea, her usual shop, once they have stock again. Here is how the content of her open checkout mandate would look, simplified, with the specification's field names:[^ap2-checkout-mandate]

```json
{
  "vct": "mandate.checkout.open.1",
  "constraints": [
    {
      "type": "checkout.allowed_merchants",
      "allowed": [
        { "id": "example-tea", "name": "Example Tea", "website": "https://example-tea.com" }
      ]
    },
    {
      "type": "checkout.line_items",
      "items": [
        {
          "id": "line-1",
          "acceptable_items": [
            { "id": "SENCHA-100", "title": "Organic sencha green tea, 100 g" }
          ],
          "quantity": 2
        }
      ]
    }
  ]
}
```

When the agent gets to payment, the store makes two checks: that **the closed mandate matches the current order** and that the open mandate's constraints are met (here, that the store is Example Tea and that the cart holds two packs of that tea).[^ap2-flows] If something does not fit, the store or the credential provider can return an unresolved-constraint error (`unresolved_constraint`) and **force the customer to approve the purchase again**: the flow without the person present becomes one with the person present.[^ap2-flows]


That an open mandate is a blank check for the agent. It is not: it is valid only for the agent whose key it carries,[^ap2-spec] within the stores, items, amounts and dates its constraints set,[^ap2-checkout-mandate][^ap2-payment-mandate] and the store and the credential provider check that the closed order meets them before charging.[^ap2-flows] **An open mandate with no useful constraints is a problem for whoever signs it, not a permission of the protocol.**


## How to check it

1. **Look at the version of the mandates you receive.** The `vct` field gives type and version, and the specification asks you to compare the exact string.[^ap2-spec]
2. **Read the constraints before accepting an order with the person absent.** The checkout ones name stores and items; the payment ones, amounts, payees and dates.[^ap2-checkout-mandate][^ap2-payment-mandate]
3. **Check that the closed mandate matches the cart you are about to charge**, recomputing the hash of the order you signed.[^ap2-spec]
4. **Keep the mandates and the receipts for every order.** In a dispute, the specification asks you to recompute that hash and check that each receipt's reference matches the hash of the corresponding closed mandate.[^ap2-spec]
5. **Ask your platform and your gateway** whether they verify AP2 mandates for you. For most stores, an intermediary will do that work, not their own code.

## Related concept: delegated payments

[Delegated payments](/glossary/delegated-payments/) are the general practice: an agent pays on behalf of a person with a permission limited in advance. The mandate is the way AP2 records that permission, as a signed record of **what was authorized, for which order and within what limits**.[^ap2-site] Other protocols delegate payment another way: the [ACP (Agentic Commerce Protocol)](/glossary/acp/) does it with a single-use credential and a maximum amount, with no mandates. And [purchase intent](/glossary/purchase-intent/) is what the open mandate turns into conditions that can be checked.

To keep going, the [AP2](/glossary/ap2/) entry explains the whole protocol and the [agentic commerce reading path](/learn/agentic-commerce/) orders the rest of the vocabulary.