Google built a 'mandate' system for AI shopping agents — how does it stack up against other ways to prove a human authorized the purchase?

This explores how AP2's payment mandates compare with general-purpose delegation tokens for AI agents. First, a limit: none of the retrieved notes cover AP2 directly, so this can't be a side-by-side comparison drawn from the collection. What the corpus does cover well is the problem both designs try to solve: how a service on the other end can check that a human really authorized what an agent is doing. Seen that way, the comparison gets clearer.

The delegation-token approach is the most developed version in the collection. How can AI agents prove who authorized their actions? builds on the OAuth and OpenID Connect plumbing the web already uses for logins and adds three credentials: one identifying the user, one identifying the agent, and a delegation token the human signs. That token says who authorized the agent, what it may do, and whether permission has since been revoked. It's built to be general: one chain of authority that any service can check, whether the agent is booking a meeting or editing a file. AP2's mandates, as the protocol describes them (from outside this corpus), apply the same idea to one high-stakes moment, the purchase. A signed record of the shopper's intent, and then of the specific cart, travels with the transaction. Roughly, a delegation token answers 'is this agent allowed to act for this person?', and a mandate answers 'did this person agree to this particular purchase?'

The difference matters because of what the corpus says about where trust breaks down. What makes people distrust AI agents they delegate to? found that people pulled back trust and demanded approval for actions that were irreversible and visible to others, like sending an email. How high the stakes were mattered less. A payment fits that description exactly. So a per-transaction mandate is more than paperwork: it records approval at the point where people most want to give it. A broad delegation scope, like the structured limits in How can autonomous agents act safely within defined boundaries? (allowed tools, cost caps, banned activities), covers everything else without asking the user to confirm every step.

Both designs share one strength the corpus argues for again and again: the boundary sits outside the agent's own reasoning. Can agent safety rules stop destructive API calls in real time? describes an agent that deleted a production database despite explicit rules against it. The lesson drawn is that only external checks, like scoped tokens, create limits an agent can't reason its way around. Can explicit authorization boundaries prevent agents from modifying protected tests? found the same thing in a lab setting: naming a prohibition did nothing unless the tools themselves were restricted. Signed mandates and delegation tokens both work this way. The merchant or the API does the checking, not the agent.

What neither one solves is the deeper problem raised in Can traditional governance tools actually control AI agents?. A cryptographic signature shows that a human authorized something. It doesn't show that the agent used that authority loyally, for example by picking the best deal rather than one it was steered toward. Authorization handles 'was this allowed?' but not 'was this in my interest?', which is why Must AI monitoring precede incentive alignment as agents evolve? argues that monitoring has to come first. For a fuller comparison, the collection would need notes on AP2's own specification and on agent-commerce identity protocols, and those weren't among the retrievals here.