Verify the supported projection without overstating coverage

Before accepting the payment

• Verify the projection and KB-JWT with an account-pinned issuer key.
• Bind the payment mandate to the expected cart or checkout hash.
• Compare the final amount and currency with the authorized limits.
• Confirm merchant identity and permitted merchant scope.
• Reject expired or excessively long authorization windows.
• Require explicit consent and a stable intent reference.
• Atomically reserve every configured cumulative budget.
• Require an audience-bound processor gateway to CONSUME the exact reservation and freshly claim its provider-bound permit before an idempotent provider operation.
• COMMIT success or RELEASE only a confirmed non-submission/failure.
• Return a structured reason for every non-ALLOW decision.
• Store a minimal receipt without payment credentials.

Why replay prevention must be durable

An in-memory set disappears when a worker restarts and does not coordinate concurrent regions. The consume-once decision belongs in a database with an account-wide uniqueness constraint on the idempotency key. Exact-input network retries recover the original result; conflicting or concurrent reuse is blocked. Use distinct, stable idempotency keys for reservation, CONSUME and the terminal transition. The hosted verification service does not require payment credentials, customers must not submit them, and it does not submit or settle payments. The customer's gateway—including an optional first-party Gate adapter—runs inside customer infrastructure, must refuse provider submission unless CONSUME succeeds and must retain the provider's own idempotency protection.

Test the normalized mandate

MandateShield's public validator accepts the policy-relevant AP2 fields and returns exact findings without requiring payment credentials.