The Mandate Gap: Why Know Your Agent Cannot Attribute a Loss
A transaction arrives at a merchant. The agent presents a signature; the merchant verifies it against the agent's public key. The mandate is signed. The token is bound to the agent's registration. Every control in the chain reports the same thing: this is a legitimate agent, acting with its principal's authority.
The transaction settles.
Three weeks later, the consumer disputes it. Not because the signature was forged, the token stolen, or the mandate fabricated. Because the agent did something the mandate did not cover — bought forty units when it was authorized to buy one, acted for a second user under the first user's delegation, or was the right agent running a version its operator had patched the week before.
The issuer opens the case. The authorization record proves the transaction was authorized. It does not say which agent acted, what its mandate was, or whether it stayed inside it. The merchant has its own records. The agent provider has its logs. No party holds a record that both sides can read.
That is the shape of the problem, and it is not hypothetical. Visa can give a merchant a cryptographic way to tell a legitimate agent from a bot. Mastercard can register the agent and bind it to a network token. Google can carry a signed mandate recording what the consumer authorized. Ant International can do the same from the wallet side. On 10 September 2026, Visa, Mastercard and Ant International said they would work toward a common Know-Your-Agent framework.
All of it answers one question: at the moment of authorization, is this agent entitled to act?
None of it answers the next one: after the transaction settles, can a party who was not in the room establish which agent acted, what it was authorized to do, and whether it stayed inside that authority?
The distance between those two questions is where the money will be lost, and it is where every protocol currently in production stops. CHAINTECH calls it the Mandate Gap.
The gap is not a secret. Six banks wrote it down in September, in a paper anyone can download:
"When things go wrong, there is unclear and inefficient allocation of liability, and disputes processes do not involve all relevant parties across the value chain."
That is not a complaint from outside the industry. It is the parties who fund the shortfall describing their own position.
What has been built
Four protocols dominate the card-rail conversation, and they have converged fast.
Visa's Trusted Agent Protocol is a signature standard. Visa describes it as "a verifiable, cryptographic standard to help merchants differentiate legitimate agents from nefarious bots or web crawlers." A trusted agent includes a message signature in its request; the merchant reconstructs the signature base string using attributes from the request and verifies it against the agent's public key. The protocol builds on RFC 9421 and defines the required signature fields.
Mastercard's Agent Pay takes a registration approach. Its own description: "Only registered agents can transact — governed and traceable with Mastercard network tokens." Its Verifiable Intent layer is "purpose-built for agentic commerce, ensuring every transaction is verified by authenticated user intent and explicit consent before an action is taken."
Google's Agent Payments Protocol (AP2) is an open protocol in which agents pay on behalf of users through cryptographically signed mandates, covering both human-present transactions (a checkout mandate) and human-not-present ones (an intent mandate). Worldline notes that Verifiable Intent is aligned with AP2 and the Universal Commerce Protocol, and integrated into Mastercard Agent Pay's intent API.
Ant International's Agentic Mobile Protocol is the wallet-side counterpart: same problem, different starting point.
On 10 September 2026, three of those four protocol owners — Ant International, Mastercard and Visa — announced they would work toward a Know-Your-Agent interoperability framework. The framing was explicit: the framework would be "based on shared principles while preserving each network's own verification and decisioning processes," aimed at helping card networks, digital wallet ecosystems, agent platforms and marketplaces onboard and identify agents across systems.
That is a genuine step: three of the four protocol owners agreed to make their definitions legible to each other.
None of this is theoretical. Worldline reports that in June 2026, Europe's first end-to-end agentic payments were completed in production across multiple countries, involving Worldline, Mastercard, Visa, Credit Agricole and ING. The protocols are not being written for a future state. They are being retrofitted onto a live one.
The name does not match the definition
Read the four descriptions again and notice how similar the shape is. Visa's answer is a signature the merchant checks. Mastercard's is a registration the network enforces, plus an intent proof tied to consent. Google's is a signed mandate the merchant verifies. Ant's is a wallet-side identity the payment network accepts.
All four are proofs presented at the door. The agent arrives, shows something, the party accepting the transaction checks it, and the transaction proceeds.
This is the right thing to have built first. It is also, structurally, a pre-transaction instrument.
Now read what an agent identity layer was supposed to carry. Worldline's 2026 paper, which uses the Know-Your-Agent framing, names it:
"a persistent and verifiable representation of agent identity, delegated authority, decision boundaries, execution permissions and liability attribution"
— in its phrase, "a machine-readable layer of economic identity and delegated trust."
Look at what is in that list. Delegated authority. Decision boundaries. Execution permissions. Every one of those is variable. The same agent that may spend a hundred dollars on books this morning may spend ten thousand on flights this afternoon, for a different user, under a different limit, with a different expiry. There is no stable object called "this agent's authority" that can be checked once and recorded.
Then read the name. Identity.
KYC works because a person's identity does not change between transactions. The customer who passed verification in January is the same customer in June. That stability is what makes a one-time check meaningful, and it is why KYC could become a compliance industry rather than a per-transaction control.
An agent has no equivalent stability. Its operator is stable. Its software version is stable for a while. Its mandate is not stable, and the mandate is what the dispute is about.
So the industry built what the name pointed at. Identity is checkable at a door, so the protocols check identity at a door. Mandate is continuous, so nothing continuous was built.
This is the Mandate Gap. It runs through three layers, which are routinely collapsed into one:
Layer | The question | Who answers it today |
Agent identity | Which agent is this, who operates it, what version | Protocols, partially — signature or registration |
Mandate | What is this agent permitted to do, for whom, up to what limit, until when | Mostly the agent provider's own logs |
Behaviour | What did it actually do, and did it leave the mandate | Nobody, in any form a counterparty can read |
The first layer is being solved. The second is asserted rather than evidenced. The third does not exist.
Everything that follows — chargebacks, fraud liability, reserve pricing, dispute resolution — depends on the third layer, and the third layer is the one the name did not ask for.
Why attribution is nobody's product
It would be reasonable to assume attribution is missing because it is hard. It is hard. But difficulty is not the reason it is missing.
The reason is a role conflict.
Verification lowers a network's risk. Attribution assigns it.
A network that builds verification is providing a service: merchants get fewer bad transactions, issuers get fewer fraudulent authorizations, the network's own exposure falls. Everyone gains, and the network gains reputation for making the rail safer. There is no downside to being the party that solved verification.
A network that standardises attribution is doing something categorically different. The moment there is a common, machine-readable record that establishes which agent acted and whether it stayed inside its mandate, the body that defined that record becomes the body that effectively decides who pays. Verification is a service. Attribution is a judgeship.
No network has volunteered for the judgeship. That is not a criticism of any of them. It is the correct reading of their incentives.
The banks are in the same position, and their own document shows it. Note what six of them published in September: principles, not a standard. Page two states it plainly — "The principles described are voluntary and non-binding."
A standard would bind its authors. Principles describe a destination without committing anyone to the route. That is a rational choice for institutions that would be first in line to fund the shortfall if the route turned out to be wrong.
And the same paper concedes, in its own words, why the parties who would have to resolve disputes cannot do it today. On data access:
issuers and acquirers "may not have real-time access to data on AI agent identity, merchant of record, consumer intent and purchase details."
On what the protocol layer has actually covered:
"The focus to date has been on protocols, mostly led by payment networks and technology platforms, and concentrated on product discovery, checkout and payment authorization."
Read that sentence twice. It is six banks saying, politely, that the protocol layer solved the front door and stopped there.
Their own principles show how far the thinking has reached. 2.2 asks that consumers be able to "view and manage delegations." 2.3 asks for secure and auditable authorization of purchase intents, "with any party holding a potential liability being able to require authentication." 2.5 sets the destination — "liability outcomes reflecting where risks and errors are introduced."
Those are the right destinations. None of them is a mechanism. A right to demand authentication only helps if you know a transaction is happening, and if there is an agent on the other end able to answer. For a human-not-present transaction that settled an hour ago, neither condition holds.
2.5 is the most honest sentence in the document. "Liability outcomes reflecting where risks and errors are introduced" is precisely what the Mandate Gap prevents. You cannot allocate by where the error was introduced if no party outside the agent's own logs can see where the error was introduced.
Where the risk actually goes
The consequence of a missing layer is not that risk disappears. It is that risk moves — and it moves toward whoever has the least ability to refuse it.
A network sets the rules; it does not absorb the loss. An agent provider holds the logs; it has no obligation to make them readable by a counterparty, and no exposure until someone proves the agent left its mandate. The merchant accepted the transaction. The acquirer cleared it.
So when the mandate cannot be evidenced, the dispute travels down that chain until it reaches a party that cannot pass it further. Usually a mid-sized merchant that had no way to audit the agent and no power to decline its traffic. Or the acquirer that boarded it. In Europe, the SCA default does the routing automatically — and Worldline sets out the mechanism: for a consumer to carry the liability, the exact merchant and amount must have been strongly authenticated. Where that is not the case, the transaction can be treated as unauthorized, and the financial risk falls back to the merchant and its payment service provider, regardless of what the merchant's terms and conditions say.
This is not a prediction about bad actors. It is what happens when a required record does not exist: the party with the weakest evidentiary position and the least pricing power funds the gap.
That is why the missing layer is a commercial problem for acquirers and PSPs before it is a policy problem for regulators. It is not an abstract governance question. It is a line item that starts appearing in dispute volumes, in reserve calculations, and in the pricing of programs that no one has yet learned how to underwrite.
The other governance model
On 24 August 2026, the Payment & Clearing Association of China issued a self-disciplinary convention on agentic payment applications, under the guidance of the People's Bank of China, effective on publication.
According to Xinhua's report of the release, it asks member institutions to further explore building a Know-Your-Agent mechanism on top of KYC; to define the authorization boundary for agentic payment applications and sign authorization agreements with users that allocate liability clearly; to operate tiered risk management with transaction limits; to give consumers a channel to switch the service off and to query their information; to refrain from exclusive arrangements, forced bundling or subsidy-driven lock-in; and to report to the association before launching agent-initiated payments, having assessed business validity, technical security and ethical compliance, with manual fallback and incident response in place.
Read that list against the Mandate Gap. It is a serious document, and it lands on the right problems: authorization boundaries, liability written into contracts, transaction limits, an off switch, pre-launch review.
It also does not close the gap. It tells members to write liability into the contract and to file before going live. It does not create a record that a counterparty in another jurisdiction can read after the fact. Neither does the six-bank paper. Two very different governance systems — one supervisory-adjacent and self-disciplinary, one voluntary and market-led — arrived at the same instruments: contracts, limits, and review. Neither produced the third layer.
That convergence is the most useful finding for anyone operating across both. The gap is not a regulatory gap. It survives regulation, and it survives self-regulation, because it sits below both of them, in the transaction record itself.
The rules will arrive after the losses
Standards are pulled into existence by volume. Visa's dispute rules exist because disputes became too numerous to handle case by case. Until a problem has a bill attached to it, it has a working group.
Agent-initiated transactions have not reached that volume, and will not for some time. That has a direct consequence for anyone waiting: the standard you are waiting for will be written by the first parties who lose enough money to demand one. It will be shaped by their losses, not by a design process.
In the meantime, liability is being allocated by whatever is available — contracts where contracts exist, and the SCA default where they do not.
That default is why so much of the industry's effort has gone into signed checkout and intent mandates. The goal is to reconstruct, for agent-initiated payments, the same tamper-resistant link between the consumer's authorization, the merchant and the amount that strong customer authentication provides today.
But a signed mandate proves what the consumer authorized. It does not prove the agent stayed inside it. Between those two statements sits the entire Mandate Gap.
Where rules are absent, contracts fill in. Worldline notes that Target has updated its terms to clarify that transactions made via its AI agent are "considered transactions authorised by you," even where the outcome does not match what the consumer intended. That is one party's answer. It is not a market answer, and in Europe it may not survive the SCA test above.
The market data reflects the absence of a market answer. Worldline cites research from Darwinium: 39% of organizations believe the AI or agent provider should be liable, 20% say the customer, and only 15% support a shared liability model. Worldline's description of the result is exact — "a vacuum without clear guidance on who owns the risk."
Worldline's conclusion on the legal position: as of 2026, no jurisdiction has enacted regulation specifically addressing agentic commerce liability.
So the sequence is not "rules, then commerce." It is commerce, then contested losses, then rules.
What to check now
For issuers
1. Decide what you will accept as evidence of agent identity at authorization — and log it. If the authorization record does not carry an agent identifier, an operator reference and a mandate reference, you cannot attribute the loss later. You can only absorb it.
2. Price the mandate, not the transaction. A per-transaction fraud score does not detect overreach, because overreach looks like a normal transaction with a normal amount at a normal merchant. The loss is conditional on scope, so the pricing has to be.
3. Put the audit-trail requirement into contracts now. The six-bank principles are voluntary today; the terms you sign this quarter are not.
For acquirers and payment service providers
4. Assume the SCA fallback applies to human-not-present agent traffic until someone proves otherwise for your portfolio. Then work backwards: what evidence would you need to shift the risk, and who would have to produce it?
5. Know your merchants' agent inventory. A merchant that has connected three agents to checkout has three more parties in the dispute chain and no additional visibility.
6. Re-read your merchant agreements with the risk-migration pattern in mind. If the contract is silent on agent-initiated transactions, the silence does not protect you. It usually routes the loss to you.
For BIN sponsors and program managers
7. Agent-facing programs change reserve math, not just onboarding. The exposure is not fraud rate; it is dispute volume from transactions that were authorized correctly and delivered incorrectly.
For agent providers
8. Principle 2.3 is the tell. Any party holding potential liability can require authentication. If you cannot service that request on demand, and evidence the mandate scope when asked, the loss will be routed to you by default — not by rule, but by the absence of one.
For anyone who thinks the standard will arrive soon
9. Do not plan around it. Plan for the period before it, which is the period you are in. The practical question is not what the eventual rule will say. It is what record you will be able to produce when a dispute arrives before the rule does.
What this piece does not claim
● No claim that the protocols are deficient. Each solves the problem it was built for. The argument is about what sits outside their scope, and about a naming choice that pointed the industry at one half of the problem.
● No claim that Worldline's definition is wrong. Its description of the identity layer already includes delegated authority, decision boundaries, execution permissions and liability attribution. The gap is between that description and what has been implemented under the Know-Your-Agent name.
● The opening scenario is a composite, not a specific incident. It is assembled from the failure modes named in Worldline's 2026 paper — overreach beyond mandate, delegation spoofing, agent hijacking — and from the data-access gap the six banks describe. It is not a report of a transaction that occurred.
● No prediction on legislation. The statement that no jurisdiction has enacted agentic-commerce liability rules is Worldline's, as of its August 2026 paper. It may date quickly.
● No assessment of whether the September KYA alignment will produce a working framework. It was announced as an intention to explore common principles.
● No assessment of any company's commercial position, including Ant International, whose protocol is referenced only as a published industry fact.
● The role-conflict reading is an interpretation, not a disclosed fact. No network has said it declined attribution for the reasons given here.
● The risk-migration argument is structural reasoning, not an empirical finding. No published study yet shows where agentic-commerce losses have landed, because the volume is not there. The direction is inferred from how existing dispute and SCA rules allocate liability.
● Darwinium's figures are second-hand — cited by Worldline, not independently reviewed here.
● Scope. The six-bank paper covers agentic commerce across cards, account-to-account and tokenized money. This piece concentrates on the card rail because that is where the protocols and the liability defaults are most developed.
● No legal advice. Liability allocation under PSD3, the EU AI Act or any other regime is a matter for counsel in the relevant jurisdiction.
Sources
● Building Trust in Agentic Commerce: Customer-centric principles for a trusted and thriving ecosystem, ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group, NatWest Group, 22 September 2026 — p.2 (status), p.4 (definition and autonomy spectrum), p.5 (protocol scope and governance gap), p.8 (data access and liability allocation), principles 2.2, 2.3, 2.5, 5.1
● Bank of America newsroom, "Global Banks Collaborate on Principles for Trusted Agentic Commerce", 22 September 2026
● Asian Banking & Finance, "Ant, Mastercard, Visa build common AI agent identity framework", 10 September 2026
● Agentic Commerce: The next transformation in how people shop, choose and pay, Worldline, August 2026, published by Edgar, Dunn & Company (11 October 2026) — report page · PDF — p.2 (June 2026 European production transactions), p.10–12 (human-present and human-not-present), p.13 (identity and intent decoupling, economic identity layer, KYA definition, risk categories), p.14 (AP2, Verifiable Intent), p.17 (liability vacuum, Darwinium, SCA fallback, Target terms), p.18 (agent hijack, shadow vendor)
● Xinhua, "中国支付清算协会发布《智能体支付应用自律公约》", 24 August 2026
Comments