Mandates Are Essential for Agentic Payments Security

AI agents are handling real money now. We’ve moved from prototype to production in 2026, and you're quite possibly handing agents payment credentials to book travel, buy inventory, or just generally execute transactions for your products on your behalf. Or, at the very least, you’re figuring out how to get that done. 

Beyond the issue of making your products and/or services findable by agents, you’re faced with a new issue: when an agent has the ability to spend your money, but then hallucinates, gets compromised, or goes sideways, nothing stops it from draining your customer’s account in seconds. That's where agentic payments mandates come in.

Hand an AI agent a payment token with no limits, and you've handed it a universal key. A mandate is the lock that makes it safe.

Mandates are structurally enforced by real payments infrastructure, so an agent cannot trick them, hallucinate around them, or ignore them

Let’s look at agentic mandates, find out what they are and how you can apply them in real-world agentic payments scenarios. 

What Are Agentic Payments Mandates?

An agentic payment mandate is a deterministic constraint attached to a Payment Method Token. It limits how the token can be used. Traditionally, when you tokenize a card, you get a PaymentMethodToken that works for any amount, at any merchant, as many times as needed until you revoke it.

This is fine when a human clicks "Buy" and money moves through a deterministic API. You knew your intent. You took the risk. But agentic commerce changes the equation: an agent is the link between you and the consumer. It decides what to buy, decides how much to spend, and it decides when it happens. The consent was given by the purchaser before the transaction actually happens, which is a different kind of transaction than you’ve ever handled before. 

A mandate makes the token weaker than the card itself. Spend up to this amount, until this date, only at this merchant. The system enforces it before any transaction reaches a gateway, so an agent can't override it, can't hallucinate past it, can't engineer consent around it because mandates aren't rules the agent follows. They're cryptographic boundaries the infrastructure verifies.

Agentic commerce mandates give you back the control

If you were to hand your teenager your unlimited credit card, they could spend $118,000 on advertising their Roblox channel just as easily as they could on getting the textbook they need for the next semester. If you give them a card that caps at $100 per day, expires on a specific day, and only works at the bookstore and the campus café, you get your peace of mind back.

The same principle applies to agentic payments. Hand an AI agent a PaymentMethodToken with no mandate and it can drain your bank account into a hacker's scheme just as easily as it can book a hotel on Priceline. Give it a token with a mandate that caps at $2,000 per transaction, expires seven days after your trip, and only works at Priceline and your hotel, and you reclaim the protection you had when you were doing the clicking yourself.

The mandate creates distance between the human who sets the limit and the agent who spends against it. The mandate creates structural distance between three distinct shapes of agentic commerce:

• Merchant's own agent: The merchant's backend sets the limit, their agent spends against it. Mandates are a guardrail against the agent going sideways.
• Agent platform (ACP): The agent platform sets the allowance, the merchant charges it, and enforcement sits in between. It crosses an org boundary, so neither side can widen it.
• Consumer-authorized (Visa, Mastercard, AP2): The consumer sets the limit and authenticates it, then the agent spends within it. The approval carries proof, so someone other than the merchant can check it too.

Could an agent work around a mandate

Three scenarios test whether mandates actually constrain an agent, or whether they're just performative.

Can the agent ignore the limit when charging?

No. The mandate isn't a prompt. It's a rule enforced by your payment processor. If an agent requests $5,000 in designer tracksuits instead of a textbook, the system returns a predictable error before the transaction touches a gateway. This stops the spend dead in its tracks before any money moves.

By contrast, a prompt that says "only spend $100" can be argued with, forgotten, hallucinated away, or lost in a context window. 

Real infrastructure beats instructions every time.

Can the agent write itself a bigger mandate

There's no point. Mandates only restrict; they never permit. A mandate can reject a transaction, but it can’t approve one. An agent writing its own mandate is just choosing how restricted it wants to be. The loosest mandate it can create is still more restrictive than a plain PaymentMethodToken.

Can it create a new token with no mandate?

Only if you give it that permission. Creating a PaymentMethodToken is a separate API capability, and operators control which ones they hand to agents. In agentic commerce, it’s a good practice to separate tokenizing and transacting capabilities. An agent gets the tools you choose to give it. Nothing else. Nada. Zip.

Infrastructure enforces the mandate’s logic

Mandates create a structural boundary between authorization and execution. The boundary is going to hold as fast as the wall at Helm’s Deep even when the agent is buggy, misaligned, or compromised, because it’s the infrastructure that enforces it.

Every agentic protocol is inventing this same primitive under a different name. OpenAI calls it an allowance, Visa calls it a Purchase Intent (called an instruction in Visa's agent-side API) carrying one or more Mandates. AP2 calls it a payment mandate and Mastercard’s Verifiable Intent uses the same term. All four mean the same thing: the credential is smaller than the card.

The best implementation works across all of them. You should be able to integrate any supported mandate structure and trust the orchestrator to enforce it correctly, the same way you already trust it to take one transaction request and speak to any gateway. Visa and Mastercard built different mandate frameworks. The industry is fragmenting instead of converging, and banks and processors have to build integrations for each standard. 

Mandates make agentic commerce less scary for consumers - Spreedly makes it less scary for merchants  

But there’s a wider issue that’s still a work in progress. Merchants and consumers don't trust agents yet, mandate or not. A hard boundary helps, but it doesn't solve that overnight. Some people are still nervous about handing money to AI.

Where mandates are going to be really important is in how they help to build trust. In the early days of the internet, people wouldn't add their credit cards to websites. Too risky. Too weird. They didn't understand how it worked and they didn't trust the infrastructure. Payment processors solved that by making the infrastructure visible and verifiable. 

Mandates do the same thing for agentic commerce. They make the boundary between authorization and execution visible, and this is what’s going to help to build the trust that both you and your consumers need to start using agentic commerce to its fullest potential.