AP2 version 0.2 describes Human Present, also called Direct, and Human Not Present, also called Autonomous. In both modes, verifiers ultimately receive closed Checkout and Payment Mandates. The trust path differs: direct approval comes from the user at transaction time, while autonomous approval relies on earlier user-signed constraints and an agent key.
Key takeaways
- Direct mode asks the user to approve the closed checkout and payment.
- Autonomous mode starts with constrained open mandates.
- The agent signs the later closed mandates with the authorized agent key.
- Verifiers evaluate both signatures and disclosed constraints.
How does the Direct flow work?
In Direct mode, the Shopping Agent receives a merchant-signed checkout. It constructs Checkout and Payment Mandate content and sends them to a Trusted Surface. The user sees the closed purchase and approves it. The resulting mandates are then sent to the merchant and payment roles for verification.
Because the user approves a specific closed checkout, AP2 notes that this can sometimes be replaced by a traditional ecommerce journey between a merchant and a trusted user interface. AP2 does not require agent autonomy where direct buyer confirmation is already appropriate.
How does the Autonomous flow work?
Autonomous mode begins before the final transaction exists. The user approves open Checkout and Payment Mandates containing constraints over acceptable purchases and payments. Those open mandates include confirmation of the agent’s public key so the later agent-signed action can be linked to the user’s authorization.
After finding a checkout that fits the constraints, the agent creates closed mandates and signs them with its agent key. Verifiers receive the user-signed open mandate and the agent-signed closed mandate, then deterministically check that the closed purchase satisfies every disclosed constraint.
What changes for the verifier?
| Verification question | Direct | Autonomous |
|---|---|---|
| Did the user approve this closed purchase? | Validate direct user authorization | Validate the delegation chain |
| Does an open mandate exist? | Not required for the basic direct case | Required to establish constraints |
| Who signs the closed mandate? | User-side authorization | Authorized agent key |
| Are constraints evaluated? | Closed purchase itself is approved | Closed purchase must satisfy open constraints |
| What reaches the verifier? | Closed mandates | Open and closed evidence with needed disclosures |
The commerce and payment roles still verify the same final purchase relationship. Autonomous mode adds a proof chain rather than removing verification.
Why are selective disclosures important?
An open mandate can contain user preferences unrelated to the final purchase. AP2 requires selective disclosure to minimize what each verifier receives. The Shopping Agent should reveal only the constraints needed to prove that the closed checkout and payment fit the authorized intent.
This privacy rule belongs in tests. A cryptographically valid mandate can still disclose more information than necessary.
What prevents repeated unauthorized purchases?
The specification states that a Shopping Agent must not present a subsequent open Payment or Checkout Mandate without receiving a rejection receipt from the previous attempt. This rule is designed to prevent the same open authorization from being used to approve several different checkouts.
Implement replay and state controls in deterministic code. A conversational model should not decide whether an authorization has already been consumed.
Flow test matrix
Create fixtures for:
- Direct approval with valid closed mandates.
- Direct approval with a modified merchant checkout.
- Autonomous approval inside every disclosed constraint.
- Autonomous payment above the authorized amount range.
- Autonomous checkout for an unauthorized merchant.
- Closed mandate signed by a different agent key.
- Reuse of an open mandate without the required rejection state.
- Excess disclosure of unrelated open-mandate data.
The expected result for each fixture should come from the current AP2 verification rules. Keep example merchant names and amounts synthetic, and never label an illustration as a production transaction.
Primary sources and review date
- AP2 specification version 0.2, reviewed 2026-08-12.
- AP2 flow examples, reviewed 2026-08-12.
- AP2 security and privacy considerations, reviewed 2026-08-12.