Receive the purchase
Send amount, currency, merchant, consent, expiry and the user-authorized mandate to one API.
PRE-PAYMENT CONTROL FOR AI AGENTS
AI agents can buy.
Make sure they buy only what was approved.
MandateShield checks every agent-initiated purchase against the user's budget, merchant, currency, consent and time limit—then allows or blocks it before payment.
For online stores, marketplaces, payment providers and agent builders. No card data required.
LIVE BOUNDARY EXAMPLE
#ms_interactive
AI agent requests
$1,499HUMAN AUTHORITY
Spend up to $150 at Rail Merchant.
!
Requested amount exceeds the hard cap by $1,349.Final merchant: Rail Merchant
$1,499 stopped at the boundary
receipt readyOne control layer across
AP2TAPUCPx402ACP
BUILT FOR YOUR PLACE IN THE FLOW
Choose your role. See exactly where MandateShield fits.
The same execution boundary works differently for an agent, a merchant, a marketplace and a payment platform.
YOUR FASTEST PATH
Give every agent a payment permission layer.
Call MandateShield as an MCP tool, A2A skill or HTTP endpoint immediately before the agent reaches checkout.
WHAT YOU GETOne stable policy surface across agent frameworks and payment rails.Connect an agent →
THE PROBLEM
An approved payment method is not an approved purchase.
A person may authorize an agent to “buy a refundable ticket for under $150.” A manipulated page, tool or second agent can still push the final checkout to $1,499 at another merchant.
MandateShield turns the original limits into deterministic checks. The model does not get to reinterpret them at the payment boundary.
Check every boundary
The engine evaluates hard limits, identity binding, replay and prompt-injection signals in milliseconds.
Allow or block
Your system receives a clear result, exact reasons and a tamper-evident receipt for the audit trail.
WHAT CHANGES
One API call prevents the wrong order from becoming a real charge.
FREE LIVE VALIDATOR
See the decision before you integrate.
Change the money or permissions with plain controls, then attack the same mandate five ways. The results come from the live public API—not a recorded animation.
LOAD A SCENARIO
Live policy engine · no account · no card or personal data
READY
Change the purchase. See where authority ends.
Run one decision or attack the same mandate five different ways.
Developer mode: edit the complete JSON envelope
purchase-envelope.json
Sent only to this live sandbox
Ready for inspection
Run the sample or change a constraint to see the verdict.
ONE POLICY, EVERY RAIL
Keep the control when standards change.
AP2, TAP, UCP and x402 cover different parts of agentic commerce. MandateShield normalizes their payment-relevant facts so your merchant policy and audit trail remain stable.
Read the merchant security guide →AP2Mandate and intent
TAPAgent identity
UCPCheckout context
x402Machine payments
ACPOrder integrity
CustomSigned envelopes
POST https://mandateshield.com/api/v1/preflightLIVE
const result = await preflight(purchase)
if (result.decision !== "ALLOW") {
stopPayment(result.findings)
}
await chargeCustomer()
store(result.receipt)SMALL INTEGRATION, HARD BOUNDARY
Put it directly before the payment call.
Test keys are created automatically after sign-in. Production keys add durable replay enforcement, retained evidence and metered billing without a sales call.
- Bearer keys stored only as hashes
- Atomic replay protection across requests
- High-volume batches of up to 25 purchases
- Self-service subscription and cancellation
MODEL THE BUSINESS CASE
Price the boundary against the value moving through it.
Set your volume and average purchase. The calculator finds the lowest-cost published plan and shows the transaction value evaluated per software dollar.
ANNUAL PURCHASE VALUE AT THE BOUNDARY$750,000,000
Lowest-cost planGrowth
Estimated monthly cost$499
Purchase value / software dollar125.3K×
This is transaction value evaluated, not promised savings. Actual loss avoidance depends on your traffic and threat rate.
Choose Growth →START FREE, SCALE BY USAGE
Production protection from $99 per month.
No implementation call, seat fee or annual contract. Create the account, choose a plan and receive the live key automatically.
LEARN WITHOUT A SALES CALL
Everything needed to make the decision.
Practical, evergreen references for merchants and developers implementing autonomous checkout.
MERCHANT GUIDE
AI agent payment security
Seven controls to verify before accepting an agent purchase.
AP2 CHECKLISTRuntime mandate validation
Binding, expiry, replay and audit evidence for production.
ARCHITECTURESecurity and threat coverage
Exactly what MandateShield checks—and what it does not claim.
RESOURCE LIBRARYSolutions and payment threats
Implementation paths for every team and failure mode.
PLAIN-ENGLISH ANSWERS
Common questions about AI-agent payment control.
What does MandateShield do?
MandateShield checks an AI agent's proposed purchase against the limits a person approved. It blocks overspend, merchant changes, expired authority, replay and other policy failures before the payment call.
Who is it for?
Online stores, marketplaces, payment providers and AI-agent builders that allow software agents to place orders or initiate payments.
Does it replace a payment processor or fraud tool?
No. It adds a pre-payment authorization control. Card processing, fraud scoring, sanctions screening and settlement remain with existing providers.
Does MandateShield receive card data?
No. The API evaluates policy metadata such as amount, currency, merchant, consent and expiry. Payment credentials stay with the merchant's payment provider.
Which agent-payment protocols are supported?
The normalized API accepts policy fields from AP2, TAP, UCP, x402, ACP and custom signed envelopes.