AP2 spend limits and payment risk checks
Agent Payments Protocol: the user's authority travels with the payment as signed mandates, so a merchant can tell what the human actually approved.
Published by Google with payment-network and merchant partners in 2025.
How authorisation works
Authority is carried in verifiable credentials called mandates. An Intent Mandate records what the user asked for and under what constraints; a Cart Mandate records the specific cart that was approved; a Payment Mandate travels to the payment network and records that an agent was involved and whether a human was present.
$320.00, procurement-agent to supplier.example.com, on AP2.
What Spend7 can verify
- ✓Whether a mandate is present and unexpired at the moment of payment
- ✓Whether the cart total stays inside the intent mandate's price ceiling
- ✓Whether the merchant is inside the mandate's declared scope
- ✓Whether the transaction is human-present or human-not-present, and whether the value is appropriate for the latter
- ✓Whether the mandate is signed at all
What goes wrong on this rail
- !A cart mandate that quietly exceeds the ceiling in the intent mandate it descends from
- !A human-not-present purchase at a value the user would never have delegated
- !An expired mandate replayed after the user's authority has lapsed
- !A merchant outside the scope the user constrained the agent to
Checking a AP2 payment
The rail block is what unlocks the protocol checks. Without it the payment still scores on caps, amount anomaly, velocity and merchant history, but no rail defect can be detected, because nothing was sent to detect it against.
curl -s https://spend7.com/api/v1/risk-check \
-H 'Authorization: Bearer sp7_live_…' \
-H 'Content-Type: application/json' \
-d '{
"intent": {
"agentId": "procurement-agent",
"amountMinor": 14800,
"currency": "USD",
"merchantId": "shop.example.com",
"category": "physical_goods",
"rail": "ap2",
"ap2": {
"intentMandatePresent": true,
"cartMandatePresent": true,
"mandateSigned": true,
"mandateExpiresAt": "2026-12-31T00:00:00Z",
"intentMaxAmountMinor": 20000,
"cartTotalMinor": 14800,
"allowedMerchants": ["shop.example.com"],
"modality": "human-not-present"
}
}
}'Questions
- Does Spend7 work with the AP2 protocol?
- Yes. Send the mandate facts on the intent: whether an intent and cart mandate are present, whether they are signed, the expiry, the intent mandate's ceiling, the cart total, the scoped merchants and the modality, and each is checked before settlement.
- What does Spend7 check on an AP2 mandate?
- That a mandate exists at all, that it is signed, that it has not expired, that the cart total stays inside the intent mandate's ceiling, and that the merchant is inside the scope the user constrained the agent to. Each of those is a decisive deny: they are invariants of the protocol, not risk judgements.
- Is a human-not-present payment treated as risky?
- It raises the floor rather than the verdict. Delegated authority is what AP2 is for, and it is also the modality in which a mis-scoped mandate does the most damage, so it adds points and lets the amount, the category and the caps decide.
- Can I cap AP2 spend separately from other rails?
- Caps are scoped by agent, merchant, category and window rather than by rail. Give the agent that transacts on AP2 its own agentId and cap that, which is usually what you actually mean.
Protocol reference: AP2 protocol. Spend7 is not affiliated with the protocol’s authors; it consumes the fields the protocol defines.