No payment credentials
The API needs authorization context, not card numbers, bank details or private keys. Settlement remains with the merchant's payment provider.
SECURITY ARCHITECTURE
Assume the agent can be manipulated. Verify every purchase anyway.
MandateShield treats the payment boundary as a deterministic control point, independent of the model's reasoning.
Cryptographic input binding
Strict v2 verifies the evidence signature and binds it to the final amount, merchant, audience, nonce or canonical purchase digest before policy checks run.
Consume-once decisions
A durable uniqueness constraint blocks sequential and concurrent reuse of the same idempotency key.
Portable minimal evidence
ES256-signed receipts store digests, assurance and the policy outcome—not the full prompt, conversation or payment credential.
THREAT COVERAGE
What the current engine checks.
Agent overspendAmount compared with mandate maximum
BLOCKMerchant substitutionMerchant allowlist binding
BLOCKCurrency switchISO currency allowlist
BLOCKExpired authorityExecution-time expiry validation
BLOCKMissing consentExplicit consent evidence required
BLOCKReplay / double executionDurable idempotency uniqueness
BLOCKPrompt override languageInjection-pattern signals
BLOCKWeak identity bindingCredential-binding requirement
REVIEWForged signed authorityJWS, SD-JWT and TAP signature verification
BLOCKSigned/final purchase mismatchCryptographic amount, payee or digest binding
BLOCKKnown cross-account abusePrivacy-thresholded fingerprint consensus
BLOCKWhat MandateShield does not claim.
A passed policy check is not fraud insurance, legal approval or proof that an AI model is safe. Merchants remain responsible for payment authorization, sanctions screening, consumer law, chargebacks and their own risk controls. MandateShield adds a narrow, auditable control before those systems execute. The AP2 verifier validates the issuer-signed token, disclosed claim digests and payment bindings; a complete delegated multi-agent trust chain still requires the issuer's trust registry. x402 settlement and facilitator verification remain with the x402 payment stack.