In January 2026, at the National Retail Federation's annual show, Google and Shopify launched the Universal Commerce Protocol — an open standard for how AI agents buy things, with Walmart, Target, Etsy and the major card networks behind it. Underneath sits the Agent Payments Protocol, announced a few months earlier with more than sixty payments partners.
Together they answer a question that had no good answer: when an AI agent spends your money, how do we prove you said yes?
Their answer is not a policy document or a code of conduct. It is a chain of signed artefacts called mandates. And the shape of that chain turns out to be identical to something built for an entirely different purpose, by people solving an entirely different problem.
That coincidence is the point of this piece.
The chain, in plain language
AP2 represents an agent purchase as up to three signed artefacts. No cryptography knowledge is needed to follow them.
The Intent Mandate is the delegation envelope. Tell an agent "buy white running shoes, size 10, under £120," and that instruction — scope, constraints, ceiling, timing — is captured and signed by you. The agent cannot exceed the envelope without coming back to ask.
The Cart Mandate is where authorisation actually happens. The merchant produces the exact cart — these items, this price, this tax, this delivery address, these refund terms — and signs it. That signature is a price lock; the terms cannot move afterwards. Then you approve, and your approval is a signature over the merchant's signed cart. What you see is provably what you pay.
The Payment Mandate is a minimal credential passed to the card network. It tells the payment rail two things it has never reliably known: an agent was involved, and whether a human was present.
The design decision worth pausing on is the second one. There are two modes. Human-present: you are in the conversation and your live approval signs the cart. Human-not-present: you signed a detailed Intent Mandate up front — "buy the tickets the moment they go on sale, up to £85" — and the agent may generate the cart authorisation on your behalf only if the envelope's conditions are precisely met.
Autonomy was not granted by relaxing the gate. It was granted by moving the human signature earlier and making its boundary machine-checkable.
The same three moves, arrived at independently
Strip away the payments vocabulary and three moves remain:
- Freeze. Fix the exact thing being authorised into an unchangeable artefact, and take its fingerprint — a hash, a short code that changes if a single character of the artefact changes.
- Sign over the freeze. The human's approval covers the frozen artefact. In AP2 the buyer's signature covers the merchant's signature, nesting commitment inside consent.
- Bind to the hash. Execution is permitted only while reality still matches the fingerprint. Changed data means a dead approval — automatically, not because someone remembered to check.
Those three moves were already the anatomy of a human-in-the-loop gate in a governance framework I've been developing for retail AI systems, not for payments. For the supply side: deciding which products a brand should expose to AI shopping agents in the first place.
The structures map one to one:
| Supply-side gate | AP2 / UCP equivalent | What it guarantees |
|---|---|---|
| Frozen manifest with payload hash | Merchant-signed Checkout Object | Terms cannot change between review and execution |
| Named-human sign-off on the frozen artefact | User-signed Checkout Mandate over the object's hash | A specific human authorised a specific state |
| Staleness voids authorisation | Mandates scoped to a checkout hash | Yesterday's approval cannot execute today's reality |
| No standing approvals | One Cart Mandate per transaction | Each execution is individually accountable |
| Automation boundary, written down | Intent Mandate: scope, ceiling, expiry, signed | The limit of autonomy is a checkable contract |
| Append-only audit trail | Non-repudiable chain of credentials | Dispute-grade evidence of who authorised what |
Two dialects, one grammar. Neither side influenced the other.
That matters more than it might appear. A framework that predicts its own correctness is worth little. A framework whose structure is independently rediscovered — by people facing real money and real liability, with cryptographers in the room — is in a different evidentiary category. You cannot manufacture that. You can only notice it.
Then I built it, and the build disagreed with me
Convergent design is a pleasant story. It is not evidence that the thing works.
So I built the supply-side gate as running software: a component that scores product catalogs for agent-readiness, freezes an approved set into a hash-bound manifest, and refuses to publish anything a named human has not signed. Then I ran it against a real catalog of 50,000 products.
The catalog was fine. The tool was wrong — in six distinct ways, none of which I would have found by reasoning.
- It divided by the wrong denominator. The tool reported "FIT, high confidence" on a source it could barely evaluate, having computed that confidence over the rules that survived filtering and then presented it as a property of the whole rubric. Seven of nine looks like 78%; seven of twenty-seven is 26%.
- It counted suppressed weight as live. Weight coverage read 85% while fourteen of twenty-seven rules were switched off — the figure was computed per category, so a category counted as fully in scope if any one of its rules survived. The true number was 39.9%.
- It measured itself instead of the catalog. Eight rules reported a 0% failure rate and looked like dead weight ready to cut; they were reading fields the adapter had fabricated — barcodes derived from product codes, a category constant, a hard-coded status. They could not fail because the adapter guaranteed they would pass, and deleting them on that evidence would have removed working checks.
- It confused a rule's signal with its parent's absence. One rule appeared to be the second-best discriminator in the rubric, failing on 48.2% of products — close to an ideal split. It was measuring whether products had any images rather than the thing it claimed to check; among products that had images, it failed 0.0% of the time.
- It drew conclusions from an axis it had suppressed. Once the scope floor blocked certification, one table still printed band counts that another section had just deprecated. A population the report declared void, resurrected two pages later.
- It scored a compliance rule whose enforcement was switched off. A disclosure check ran, produced numbers, and appeared in the compliance section — while the rule meant to block publication sat inert, waiting on a legal question. Nothing in the output said so.
What those six have in common
None of them is subtle. Two are arithmetic an undergraduate would catch. What let them survive is that their outputs were plausible.
85% weight coverage looks reasonable. "FIT, high confidence" looks like a system working. A rule failing on 48% of products looks like exactly the discriminator you'd hope for. Nobody re-derives a figure that sits comfortably in the expected range.
Crude errors survive when their output is plausible. The defence is not a cleverer metric. It is a visible derivation.
The fix in every case was the same move — make the number re-derivable from source. The reports now print each rule's weight, struck through when suppressed, so a reader can add nine numbers by hand and get 39.91. They separate a rule's own failures from failures inherited from a missing prerequisite. They declare which fields the adapter fabricated. They refuse to publish a certification band when the source cannot answer enough of the rubric, and they say so rather than quietly lowering the bar.
The tool now talks itself out of conclusions it cannot support. On that 50,000-product run it returns UNFIT, confidence NONE, and blocks the two decisions it was built to inform.
That is the correct answer. It took nine revisions to make it say so.
Why this matters now
Shopify has opened its catalog infrastructure to brands on any platform. Products are entering AI channels — ChatGPT, Copilot, Gemini, Meta — with data quality named by the platform itself as the primary failure mode. When an agent queries that catalog, the platform ranks the results and the agent re-ranks them again before a shopper sees anything. Brands control inputs, not outcomes.
Which means the input layer is the only lever, and nobody has built the governed version of it. The platforms have no incentive to: their interest is volume through the rail, not helping a brand decide what belongs on it.
If you are responsible for governing an AI system in production, three things from this are worth carrying:
- The gate did not disappear; it became a signed contract. When someone tells you human-in-the-loop cannot scale to autonomous operation, the payments industry is the counterexample, built at scale with liability attached.
- Structure your delegation as a mandate, not a permission. Scope, cumulative ceiling, expiry date, and a rule for what voids it. Open-ended delegation with no expiry is not a mandate — it is abdication with a signature on it.
- Assume your governance metrics are wrong until you can re-derive them. Not because they are sophisticated, but because they are plausible. Every one of the six failures above sat in that comfortable range where nobody checks.
The component, rubric and calibration reports described here exist as working code. The evidence is early: three sources evaluated so far, and the tool currently refuses to certify any of them. That refusal is the finding, not a conclusion about what catalogs can achieve — a richer feed may well clear the bar, and I would rather be corrected by data than defend a number.