AG-809
Autonomous Payment Mandate Authorisation
EU AI Act
NIST AI RMF
ISO 42001
AGS Agentic Commerce | Financial Controls, Payments & Accounting | Version 2.2
Autonomous Payment Mandate Authorisation governs the rule that an agent may only initiate or execute a payment under a verifiable, user-authorised *mandate* that cryptographically binds the permitted amount, payee/merchant category, time window, and single-use-versus-recurring nature — producing a non-repudiable trail of user intent for every agent-initiated transaction.
As agents transact on users' behalf (agentic commerce, autonomous procurement, on-chain actions), the core risk is an agent spending outside the user's intent — through error, hallucination, manipulation, or compromise. This dimension adapts emerging agentic-payment protocols (e.g. mandate-based authorisation) into a governance control distinct from internal tool-spend caps (AG-375) and resource budgets (AG-807).
In scope: user-signed payment mandates with explicit constraints; intent-vs-execution binding; non-repudiable intent trail; liability/accountability attribution for agent-initiated payments; mandate revocation.
Out of scope: internal tool billing caps (AG-375), compute/cost budgets (AG-807), and general financial-crime controls (Group E). This dimension governs *authorisation of agent-initiated external payments*.
An agent that can move money without bounded, provable user authorisation is a direct financial-loss and dispute risk: a single hallucinated or injected instruction could trigger an unintended or fraudulent purchase, with no clear evidence of what the user actually authorised. Cryptographic mandates make every agent payment provably within user-defined limits and create the intent evidence needed to resolve disputes and assign liability across user, agent operator, merchant, and payment provider.
Test 6.1: Mandate-Bound Payment
Test 6.2: Non-Repudiable Intent
Test 6.3: Revocation
| Score | Criteria |
|---|---|
| 0 | Agent can initiate payments without a bounded, verifiable user mandate |
| 1 | Per-transaction confirmation + spend cap, but no cryptographic mandate or intent trail |
| 2 | Cryptographic user-signed mandates with constraints, hard blocking, non-repudiable trail, revocation |
| 3 | Intent/execution separation, cross-party liability attribution, role-scoped data minimisation, dispute-ready evidence |
Scenario A — Hallucinated Purchase: A shopping agent misreads a request and orders the wrong high-value item. Without a mandate bounding amount and merchant, the spend executes; with AG-809, it exceeds the mandate and is blocked.
Scenario B — Injected Transaction: A malicious product listing injects an instruction to send funds to an attacker. The mandate's payee constraint blocks the disallowed payee, and the absence of a matching mandate prevents execution.
Scenario C — Disputed Spend: A user disputes an agent purchase. Because a cryptographic mandate recorded the authorised constraints and intent, the dispute is resolved on evidence and liability is attributed per the recorded boundaries.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Mandate-bound payment authorisation | Art. 14 — Human oversight | GOVERN 2.1 — Accountability | A.9 — Use of AI systems |
| R2: Cryptographic, user-bound mandate | Art. 12 — Record-keeping | GOVERN 2.1 — Accountability | Clause 8.1 — Operational control |
| R3: Intent vs execution separation | Art. 14 — Oversight | MANAGE 1.3 — High-priority response | A.9 — Use of AI systems |
| R4: Hard-block out-of-mandate payments | Art. 14 — Human oversight (stop) | MANAGE 1.3 — High-priority response | Clause 8.1 — Operational control |
| R5: Non-repudiable intent trail | Art. 12 — Record-keeping/traceability | GOVERN 2.1 — Accountability | Clause 8.1 — Operational control |
| R6: User revocation | Art. 14 — Human oversight | MANAGE 2.4 — Deactivation | A.9 — Use of AI systems |
| R7: Cross-party liability attribution | Art. 26 — Deployer responsibilities | GOVERN 2.1 — Accountability | A.3 — Internal organization |
| R8: Role-scoped data minimisation | Art. 10 — Data governance | MEASURE 2.10 — Privacy risk | A.7 — Data for AI systems |
Article 14 (human oversight) requires that consequential actions remain under meaningful human authority; a payment mandate is the bounded, revocable authorisation that keeps autonomous spend under user control. Article 12 (record-keeping) underpins the non-repudiable intent trail.
GOVERN 2.1 (documented roles and accountability) and MANAGE 1.3 (high-priority risk response) frame mandate-bound authorisation and hard-blocking of out-of-mandate payments as accountability and risk-response controls.
Clause 8.1 (operational control) and Annex A.9 (responsible use of AI systems) require that agent-initiated financial actions operate within defined, authorised bounds.