Delegated authority, mandates, consent and liability
Banks must distinguish an authenticated agent from a properly authorized action, enforce scoped mandates, manage revocation and record responsibility for errors.
Executive question
Who authorized an agent to do what, under which conditions, and how is that proved?
What to measure
- Mandate validation / revocation
- Unauthorized or disputed actions
- Consent traceability and recovery
Relevant products and standards
Agent Payments Protocol: signed mandates that prove a customer authorized an agent's purchase. Created by Google (Sep 2025); donated to the FIDO Alliance with v0.2 on 28 Apr 2026.
Mastercard's agentic payments program using Agentic Tokens. Announced Apr 2025; enabled for US cardholders by late 2025; live test transactions with 17 Latin American issuers and processors (Mar 2026).
Personal Agent Protocol: a draft (v0.1) for a customer's personal agent to identify itself to a business, get consent and open a session. Announced by Sierra and Meta on 6 Oct 2026 with six named partners; the 9 Oct draft lists seven initial partners and 35 design partners.
Visa's program for agent-initiated card payments: agent tokens, the Trusted Agent Protocol and the Agentic Ready issuer program. Live in the US and Europe; expanding in Asia-Pacific and Latin America.
Relevant examples, not documented integrations, completeness, certification or endorsement. Listed alphabetically.
Evidence and current limits
SAFR and protocols are not universally deployed bank authorization systems.
Draft analysis, under editorial review.