UCP payment security at checkout execution

What the protocol establishes

UCP provides a common language for commerce capabilities and services. Interoperability does not remove the merchant's need to enforce the customer's approved constraints immediately before money moves.

Five checks before execution

1. Resolve the negotiated capability and protocol version.
2. Normalize the checkout into stable policy fields.
3. Compare total, currency and seller with the approved mandate.
4. Reject missing consent, stale evidence or ambiguous identity.
5. Persist a consume-once receipt before payment execution.

The gap MandateShield closes

A syntactically valid UCP checkout may still exceed the user's budget or reflect a merchant substitution introduced upstream.

MandateShield normalizes execution facts and returns a deterministic decision with exact findings and a tamper-evident receipt. It complements protocol-native signature verification; it does not replace it.