Intent Authorization and Mandates

Question 1

What is Know Your Intent (KYI)?

Accepted Answer

Know Your Intent (KYI) is the check, made before an AI agent acts, that the action it proposes falls inside what its user authorized. The full explanation is in our KYI post.

Question 2

Why is agent identity not enough to authorize a payment?

Accepted Answer

Identity tells you which agent is paying and who stands behind it, not whether this payment is one its user approved. A verified, well-behaved agent can still be given a bad instruction, be manipulated or go beyond what it was asked to do. Authorizing the payment needs a second check against what the user actually agreed to.

Question 3

What is the difference between KYC, KYA, KYT and KYI?

Accepted Answer

KYC verifies the person, KYA verifies the AI agent acting for them, KYT monitors transactions for money laundering and fraud risk, and KYI checks that a specific action matches what the user authorized. KYC and KYA answer who is acting; KYT and KYI answer what is happening. An agent payment needs all four.

Question 4

What is Know Your Transaction (KYT)?

Accepted Answer

Know Your Transaction (KYT) is monitoring payments, in real time or after the fact, for signs of money laundering, fraud or sanctions exposure. It flags transactions that look unusual for the customer or involve risky counterparties. AML rules such as FinCEN's CDD Rule require ongoing monitoring to identify and report suspicious transactions.

Question 5

KYT vs KYI: what is the difference?

Accepted Answer

KYT asks whether a transaction looks risky, judged against patterns, counterparties and sanctions lists. KYI asks whether this specific action is what the user authorized their agent to do. A payment can pass KYT, with a known merchant and a normal amount, and still fail KYI because the user never asked for it.

Question 6

Does KYI replace KYT or AML monitoring?

Accepted Answer

No. KYT is a legal obligation for regulated institutions, and it looks for financial crime across all transactions. KYI covers a different risk: an agent acting outside its user's instructions. KYI records can support monitoring and disputes, but banks and payment firms still have to run their AML transaction monitoring.

Question 7

In what order do KYC, KYA, KYI and KYT run on an agent payment?

Accepted Answer

KYC or KYB comes first, when the user or business is onboarded. KYA follows when their agent is registered, and is repeated as the agent changes. KYI runs at the moment of each action, before it executes. KYT runs as the payment moves and afterwards, monitoring for financial crime.

Question 8

Which of these checks happen before a payment, and which after?

Accepted Answer

Before: KYC or KYB at onboarding, KYA when the agent registers and on its requests, and KYI on each proposed action. During and after: KYT, which screens the transaction and keeps watching patterns across payments. KYT can block a payment in real time, but it judges risk, not whether the user asked for it.

Question 9

Who runs each check in an agent payment?

Accepted Answer

The bank, payment provider or platform that onboards the user runs KYC or KYB. Card networks, merchants and agent platforms verify the agent; Visa's and Mastercard's agent programs work with approved or registered agents. KYI sits wherever the agent's action is authorized, before it runs. Regulated institutions run KYT.

Question 10

Why can't transaction monitoring catch an AI agent's mistake?

Accepted Answer

Because the mistake looks normal. An agent that books the wrong flight or buys an item twice pays a legitimate merchant from a verified account, at an ordinary amount. Nothing in the pattern is suspicious. Only a check against what the user actually authorized, made before payment, shows the action was wrong.

Question 11

If an AI agent passes KYA, does it still need KYI?

Accepted Answer

Yes. KYA proves the agent is genuine and tied to an accountable owner. It does not prove a given purchase was requested. A verified agent can misread an instruction, be manipulated through prompt injection, or act on stale context, and still present valid credentials. KYI checks each action itself.

Question 12

Can KYT tell whether an AI agent made a payment?

Accepted Answer

Usually not on its own. Payment data shows the account, merchant, amount and channel, not which software started the request. Agent programs such as Mastercard Agent Pay, with its Agentic Tokens, and Visa's Trusted Agent Protocol are starting to identify agents, which gives monitoring more context to work with.

Question 13

What does each check prove in a dispute?

Accepted Answer

KYC proves who owns the account. KYA proves which agent acted and who answers for it. KYI proves what the user authorized and whether the action matched it, ideally with a recorded decision. KYT shows how the payment compared with normal activity. In an agent dispute, the authorization record is usually the key evidence.

Question 14

Are KYA and KYI required by regulation?

Accepted Answer

Not specifically, as of October 2026. Regulated institutions must run KYC and ongoing transaction monitoring under AML rules such as FinCEN's CDD Rule and the FATF Recommendations. KYA and KYI are emerging practices for agent payments, driven by card network agent programs and the need for evidence when agents act.

Question 15

How does KYI relate to AP2 mandates?

Accepted Answer

AP2 records what the user approved: an Intent Mandate setting the rules for a task, and a Cart Mandate for the exact items and price, both signed by the user. KYI is the check that an agent's proposed action stays inside such an authorization before it runs, plus the record of that decision.

Question 16

Why compare KYC with KYA, and KYT with KYI?

Accepted Answer

Because each pair asks the same question about a new actor. KYC asks who the customer is; KYA asks the same of the agent. KYT asks whether a transaction looks right; KYI asks whether this action is what the user authorized. The agent checks extend existing controls rather than replacing them.

Question 17

How do you prove a user authorized what an AI agent paid for?

Accepted Answer

Keep three records linked together: the user's authorization, captured before the payment as a signed mandate with its limits; the payment the agent actually made; and the check that compared the two at the time. AP2 builds this as a chain of signed mandates, which Google describes as a non-repudiable audit trail.

Question 18

What is intent authorization for AI agents?

Accepted Answer

Intent authorization is checking, before an AI agent acts, that the specific action it proposes matches what its user asked for and allowed. It sits between identity, which says who the agent is, and settlement, which moves the money, and it decides whether this particular payment should happen at all.

Question 19

What is an agent payment mandate?

Accepted Answer

An agent payment mandate is a record of the authority a user gives an AI agent to pay: what it may buy, from whom, up to how much and until when. In AP2, mandates are cryptographically signed, so they can be verified later as proof of exactly what the user approved.

Question 20

What should a payment mandate for an AI agent contain?

Accepted Answer

At minimum: who granted it and to which agent, the allowed merchants or recipients, the maximum per payment and in total, the currency, what may be bought, when it starts and expires, whether it is one-off or recurring, any approval thresholds, and a signature that makes it tamper-evident.

Question 21

How do you verify an agent's action matches the user's original instruction?

Accepted Answer

Express the instruction as structured terms, such as item, merchant, amount and deadline, rather than leaving it as free text. Before paying, compare the proposed action field by field against those terms and refuse anything outside them. In AP2, an agent can only complete a delegated purchase when the user's pre-signed conditions are met.

Question 22

What is a verifiable receipt for an agent transaction?

Accepted Answer

A verifiable receipt is a signed record of an agent transaction and the decision behind it: what was attempted, which mandate and rules it was checked against, the outcome and when. Because it is signed, anyone with the verifying key can confirm it has not been altered, which makes it usable in audits and disputes.

Question 23

How do you audit what an AI agent was allowed to do at the time it paid?

Accepted Answer

Keep the authorization exactly as it stood at the moment of payment, not only its current version. Store each mandate version with its validity period, link every payment to the version it was checked against, and record the result of the check. An auditor can then replay the decision even after the rules have changed.

Question 24

What happens when an AI agent's action falls outside its mandate?

Accepted Answer

It should be stopped before it executes. A well-designed check denies the payment, tells the agent which rule it broke and records the attempt. In AP2, an agent can only act on a delegated mandate when the user's conditions are met, and in ACP a delegated token cannot be used beyond its allowance.

Question 25

How is intent authorization checked before payment, not after?

Accepted Answer

The check sits in the payment path: the agent submits the proposed payment, the policy compares it with the user's mandate, and only an approval lets the payment proceed. Reviewing payments afterwards can only flag damage already done, which is why the decision has to come first, especially for payments that are hard to reverse.

Question 26

What is the difference between authentication and authorization for AI agents?

Accepted Answer

Authentication proves who the agent is, for example by verifying a signature on its requests. Authorization decides what it may do: which payments, to whom and up to how much. A properly authenticated agent can still attempt an unauthorized payment, so payment systems need both checks, not just the first one.

Question 27

How does KYI help resolve disputes on agent payments?

Accepted Answer

A dispute asks whether the user really authorized a payment. KYI keeps the evidence: the mandate the user approved, the payment the agent proposed and a signed record of the check between them. That shows whether the agent stayed within its authority, and so whether the claim concerns the agent or the user's original instructions.

Question 28

What is the difference between a mandate and a policy?

Accepted Answer

A mandate is the authority a particular user gives a particular agent, such as buying these tickets under this price by Friday. A policy is a standing rule set by the business or account owner, such as never paying unknown addresses or more than a fixed amount. A payment should satisfy both before it goes ahead.

Question 29

How do you express a user's intent in machine-readable form?

Accepted Answer

Use structured fields with defined meanings instead of free text: action, item or category, merchant, maximum amount, currency, recurrence and expiry. OAuth Rich Authorization Requests define this pattern for payments, carrying JSON authorization details such as the amount and payee, and AP2 records the user's intent in signed mandates.

Question 30

Should a user's payment intent expire?

Accepted Answer

Yes. Intent that never expires turns into standing authority nobody remembers granting. Give each mandate an end date that fits the task, short for a single purchase and longer only for ongoing arrangements, and let the user revoke it at any time. ACP's delegated payment tokens, for example, stop working at their expiry.

Question 31

What is a cryptographically signed mandate?

Accepted Answer

A cryptographically signed mandate is a record of authority carrying a digital signature from the party that issued it. Anyone with the matching public key can check who signed it and that it has not changed since. AP2 describes its mandates as tamper-proof, cryptographically signed digital contracts that prove a user's instructions.

Question 32

Who signs an agent mandate: the user, the agent, or the platform?

Accepted Answer

It depends on the design. In AP2, the user's approval signs the mandate, so it proves the user's own consent. In other designs, the platform seals the mandate with its own key after authenticating the user. Either way, the agent should never be the one that signs its own authority.

Question 33

Can a mandate be changed or revoked after an agent starts acting?

Accepted Answer

It should be. The user should be able to revoke a mandate at any time, stopping further actions under it, and a change should create a new version rather than editing the old one, so earlier payments stay tied to the terms that applied then. Under US Regulation E, a consumer's notice ends someone's authority to make transfers.

Question 34

What is a one-off vs recurring mandate for an AI agent?

Accepted Answer

A one-off mandate covers a single purchase and ends once it is used. A recurring mandate lets the agent pay repeatedly, for example monthly, within a limit per payment and an end date. Recurring mandates need closer review, because every new charge relies on consent the user gave earlier.

Question 35

Which industries need intent verification for AI agents first?

Accepted Answer

Those where agents already move money and mistakes are costly: consumer checkout, business payables and procurement, banking and crypto. Card networks have launched programs for shopping agents, and Visa has piloted agents paying buyer-approved supplier invoices, so checkout and B2B payables are early proving grounds.

Question 36

How do you represent delegated authority from a user to an AI agent?

Accepted Answer

Use a credential that names both parties and the limits: who granted the authority, which agent holds it, what it covers and until when. OAuth token exchange expresses delegation with an actor claim that identifies the agent acting for the user, and AP2 mandates record the user's signed authorization for payments.

Question 37

How do you prove an agent acted within policy after the fact?

Accepted Answer

Record each decision when it is made: the payment the agent proposed, the policy version it was checked against, the result and a timestamp, signed so it cannot be altered later. Linking each payment to that record lets an auditor confirm the policy was applied, instead of reconstructing it from logs afterwards.

Question 38

Who is responsible for an AI agent's actions: the user, developer or platform?

Accepted Answer

There is no single answer yet. The UN Electronic Communications Convention treats contracts formed by automated message systems as enforceable even when no person reviewed each action, so a user or business that deploys an agent can be bound by its deals. How losses are shared with developers and platforms is largely set by their contracts.

Question 39

What is delegated authorization for AI agents?

Accepted Answer

Delegated authorization is giving an AI agent permission to act for a user while keeping the two identities separate. The agent holds its own credentials plus a limited grant from the user, unlike impersonation, where it would simply act as the user. OAuth token exchange spells out this difference between delegation and impersonation.

Question 40

How do OAuth scopes compare with payment mandates for AI agents?

Accepted Answer

OAuth scopes grant coarse access, such as permission to make payments from an account. A payment mandate defines specific terms: which payee, how much, what for and until when. OAuth's own Rich Authorization Requests extension notes that scopes are not enough for fine-grained authorization such as approving a specific payment.

Question 41

Can an AI agent act for a company instead of a person?

Accepted Answer

Yes. The company is the principal: it passes KYB, sets the agent's mandate and policies, and is accountable for its payments. Visa, BILL and Billtrust have piloted agents paying a business's supplier invoices, executing only payments the buyer had already approved, which shows the pattern: the company approves and the agent executes.

Question 42

How do you stop an AI agent from splitting a large payment into small ones?

Accepted Answer

Enforce limits on totals as well as on single payments: caps per period, per merchant and per recipient, counted across all of the agent's payments. Flag runs of payments just under a limit. In anti-money-laundering rules, deliberately splitting transactions to avoid reporting is called structuring, and the same pattern defeats per-payment limits.

Question 43

How do you limit an AI agent to one-off purchases, not recurring commitments?

Accepted Answer

Allow only payments that settle once, with no stored credential, subscription or future commitment. Use a single-use card or a delegated token limited to one amount and merchant, and block checkouts that create a recurring charge. In card terms, avoid stored credentials that let a merchant initiate charges later.

Question 44

What is a human-in-the-loop payment for AI agents?

Accepted Answer

A human-in-the-loop payment is one the agent prepares but a person approves before it executes, typically above a value threshold or for a new payee. AP2 distinguishes human-present purchases, where the user signs off on the cart, from delegated ones the agent completes alone within rules the user signed in advance.

Question 45

Does an AI agent need its own legal identity?

Accepted Answer

No. An AI agent is software acting for a person or business, and theirs is the legal identity that counts. The UN Electronic Communications Convention, for instance, makes contracts formed by automated systems enforceable even without human review of each action. What an agent needs is a verifiable technical identity tied to its accountable principal.

Question 46

What is a sealed policy and why should it be tamper-proof?

Accepted Answer

A sealed policy is a set of spending rules that is signed or locked when created, so neither the agent nor anyone else can quietly change it. Tamper-evidence matters because an agent able to edit its own limits effectively has none. Any change should require a new version, signed by the owner.

Question 47

What is commitment shape in agent payment policies?

Accepted Answer

Commitment shape is the form of obligation a payment creates: a single purchase, a recurring subscription, a deposit, an instalment plan or a card stored for future charges. Policies should limit shape as well as amount, because a small first charge can commit the user to much larger payments later.

Question 48

How do you share one budget across multiple AI agents?

Accepted Answer

Hold the budget in one place rather than in each agent. Every agent's payment draws down a shared balance, checked atomically so two agents cannot spend the same remaining amount, and each agent can have its own sub-limit too. Report spend per agent, so the owner can see who used what.

Question 49

How do you handle an AI agent acting across time zones and billing periods?

Accepted Answer

Define every limit against one reference clock, usually UTC, and store timestamps with their UTC offset so periods are unambiguous. Decide whether a daily or monthly budget resets at the user's local midnight or on the billing calendar, apply that consistently, and check each payment against the period its timestamp falls in.