UCP payment security at checkout execution

What the protocol establishes

UCP provides a common language for commerce capabilities and services. Interoperability does not remove the merchant's need to enforce the customer's approved constraints immediately before money moves.

Five checks before execution

1. Resolve the negotiated capability and protocol version.
2. Normalize the checkout into stable policy fields.
3. Compare total, currency and seller with the approved mandate.
4. Reject missing consent, stale evidence or ambiguous identity.
5. Reserve cumulative budget, then require an audience-bound processor gateway to CONSUME once before submission.

The gap MandateShield closes

A syntactically valid UCP checkout may still exceed the user's budget or reflect a merchant substitution introduced upstream.

MandateShield normalizes execution facts and returns a deterministic decision with exact findings. Strict v2 verifies supported evidence and returns an ES256-signed receipt with public transparency; it complements the protocol's wider trust and settlement chain.