AI PAYMENT THREAT · CONSENT DRIFT
Keep AI purchases inside current user consent
Consent must apply to the final purchase, not merely to an earlier conversation with an agent.
Where the failure appears
An old approval may no longer represent the user's intent after a price, merchant, cart or delivery change. Long-lived and ambiguous authority creates consent drift.
Who needs the control
Agentic commerce systems where time, inventory, price or fulfillment details can change between instruction and checkout.
Execution-time response
- Capture explicit consent with a stable mandate reference.
- Use a short expiry appropriate to the transaction.
- Bind material checkout facts to the approved intent.
- Route incomplete evidence to review and block expired authority.
Relevant controls
Explicit consent stateMandate identifiersShort expiry windowsIntent bindingCheckout-change detectionReview outcomes
What changes
Execution proceeds only when the evidence still represents the user's current and specific authority.
Reproduce the failure safely
Change a sample amount, seller, consent field or instruction and inspect the structured decision before integrating.
Test the threat free →