The Agent Factory - Episode 8: Agent payments, can you do my shopping?

Key Concepts

• Agent Payment Protocols (AP2): An open protocol designed to add a trust layer on top of existing payment systems, enabling secure AI agent-driven commerce.
• Role-Based Ecosystem: A system where different entities (shopping agent, merchant endpoint, credential provider, merchant payment processor) have specific responsibilities, promoting separation of concerns.
• Verifiable Credentials (VCs): Protocolized, cryptographically signed digital receipts that prove what was agreed upon, ensuring trust and accountability. Types include cart mandates, intent mandates, and payment mandates.
• Contractual Conversational Model: A payment flow built on verifiable proof, moving beyond simple API calls to a series of verifiable handshakes.
• Human-Present vs. Human-Not-Present Scenarios: Distinctions in payment authorization based on whether the user is actively involved in the transaction.
• Decentralized Registries of Trust: Shopping agents maintain lists of trusted merchants, facilitating secure interactions.

Agent Payments: Addressing the Trust Gap in AI Commerce

The core issue preventing widespread adoption of AI agents in commerce is the lack of trust. Current payment systems assume direct human interaction, which doesn't translate well to autonomous agents. The podcast identifies three key challenges:

1. Authorization: Proving the user genuinely authorized the specific purchase.
2. Agent Error: Protecting against agent "hallucinations" or mistakes.
3. Accountability: Determining responsibility when something goes wrong.

The Agent Payment Protocols (AP2) aims to solve these challenges by creating a secure "trust layer" on top of existing payment infrastructure.

The Role-Based Ecosystem: Separation of Concerns

AP2 introduces a role-based ecosystem to separate responsibilities and enhance security. Key players include:

• Shopping Agent: The AI agent responsible for finding the right products at the best price.
• Merchant Endpoint: The seller's API where transactions occur.
• Credential Provider: A secure digital wallet that manages user payment methods and selects the optimal payment method for each transaction. It never exposes raw payment credentials to the shopping agent.
• Merchant Payment Processor (MPP): Responsible for constructing the final authorization message for payment networks.
• Payment Networks and Issuers: Verify transactions and ensure security.

This separation ensures that the shopping agent doesn't need to be PCI compliant, as it never directly handles sensitive payment information.

Verifiable Credentials: The Foundation of Trust

Verifiable Credentials (VCs) are central to AP2's trust mechanism. They are cryptographically signed digital receipts that prove what was agreed upon. There are three main types:

1. Cart Mandate: Used in human-present scenarios. The user reviews the final cart and their approval creates a cryptographically signed mandate, preventing later disputes.
   • Example: User approves a specific concert ticket purchase after reviewing the details.
2. Intent Mandate: Used in human-not-present scenarios. The user signs an intent (e.g., "buy tickets under $200"), giving the agent authority to act autonomously within those guidelines.
   • Example: User authorizes an agent to buy a dress in red when it becomes available, with a price limit.
3. Payment Mandate: Provides payment networks and banks with clear visibility into transactions, explicitly indicating AI agent involvement and whether the interaction was human-present or human-not-present.

The Contractual Conversational Model: A Step-by-Step Flow

AP2 establishes a "contractual conversational model" based on verifiable proof. The process involves several steps:

1. Delegation of Task: The user instructs the agent (e.g., "buy two concert tickets").
2. Discovery and Negotiation: The agent contacts the merchant endpoint to prepare the cart, handling loyalty programs and special offers.
3. Payment Method Selection: The agent reaches out to the authorized credential provider, allowing the user to select a payment method. The agent only receives a reference to the credential (e.g., last four digits).
4. Authorization with Mandates: The agent presents the final cart to the user (in human-present scenarios), who then cryptographically signs the cart mandate. In human-not-present scenarios, an intent mandate is used.
5. Sending the Mandate to the Merchant: The agent sends the signed mandate to the merchant, who can trust its authenticity.
6. Payment Processing: The merchant sends the signed payment information to the merchant payment processor (MPP).
7. Credential Retrieval: The MPP contacts the credential provider to get the actual payment method.
8. Transaction Authorization: The MPP constructs the final transaction authorization message, allowing the network to verify the AI agent's involvement and challenge the user if necessary.

Establishing Trust: Allow Lists and Web Standards

AP2 employs a two-phase approach to establishing trust:

• Short Term: Manual creation of allow lists of approved agents and providers, creating a "walled garden" for security.
• Long Term: Leveraging established web standards like HTTPS, DNS ownership, and MTLS to assert the identities of agents and users.

Accountability: Determining Responsibility

Pratik Duda provides an example to illustrate accountability: If a user approves a purchase of blue shoes (human-present scenario) after seeing the product SKU, they are responsible even if they later claim they wanted teal shoes. The signed cart mandate serves as evidence of their approval. Similarly, in human-not-present scenarios, the intent mandate defines the conditions under which the agent can act, and the user is responsible if those conditions are met.

Reference Implementation and Compatibility

A reference implementation of AP2 has been built and demonstrated, showcasing a user interacting with a shopping agent to make a purchase. The protocol is compatible with various AI agent frameworks, including Google's ADK, LangGraph, and CrewAI, as long as they support A2A or MCP protocols.

Getting Started with Agent Payments

To get started with AP2, developers can:

1. Explore the GitHub repository to understand the different roles.
2. Build a merchant agent, credential provider agent, or PSP agent based on their area of interest.
3. Utilize agent sample cards for each role.
4. Look forward to the release of an SDK for embedding AP2 capabilities into existing agents.

Future Applications: Dynamic Negotiation and E-commerce

Pratik Duda highlights the potential for dynamic negotiation in e-commerce. For example, an agent could negotiate with a merchant to secure a red dress that is currently unavailable, offering to pay a premium for it. This could convert lost sales into profitable transactions, benefiting both users and merchants.

Conclusion

The Agent Payment Protocols (AP2) represents a significant step towards enabling secure and trustworthy AI agent-driven commerce. By establishing a role-based ecosystem, leveraging verifiable credentials, and implementing a contractual conversational model, AP2 addresses the key challenges of authorization, agent error, and accountability. The protocol's compatibility with existing payment systems and AI agent frameworks, combined with its potential for dynamic negotiation, positions it as a crucial component for building the future of AI-powered commerce.