AP2 (Agent Payments Protocol) Architecture Diagrams (2026)

The Agent Payments Protocol (AP2) is Google's open standard for letting AI agents transact on a user's behalf — announced September 16, 2025 alongside Coinbase, with more than 60 launch partners including Mastercard, PayPal, American Express, and Salesforce. AP2 is now under the stewardship of the FIDO Alliance, making it a vendor-neutral standard rather than a Google-controlled one. As agents move from browsing and drafting to actually buying things — booking travel, reordering groceries, procuring vendor contracts — AP2 defines the missing trust layer: a cryptographically verifiable record of what a user authorized, what an agent selected, and what was actually charged.

This guide explains the AP2 mandate chain, where it sits relative to MCP and A2A, how it compares to the adjacent UCP and ACP standards, and how to lay out an AP2 architecture diagram for a design review, security audit, or payments integration doc — with prompt templates you can adapt directly.

Why agent payments need a new protocol

Traditional e-commerce assumes a human is present at checkout to type a card number, click "confirm," and take on liability for the purchase. An autonomous agent breaks that assumption: the merchant can no longer see the human, the payment network has no proof the human actually wanted this specific cart, and the card issuer has no way to distinguish an authorized agent purchase from fraud. AP2 solves this by replacing the "human clicked confirm" signal with a chain of cryptographically signed, verifiable authorizations that travel with the transaction — so every party (merchant, processor, issuer) can independently verify what was authorized without re-contacting the user.

Where AP2 sits in the agentic stack

AP2 is not a replacement for the protocols that already govern agent reasoning and delegation — it's a layer above them. MCP standardizes how an agent calls tools (a product search API, a merchant catalog lookup). A2A standardizes how one agent delegates a subtask to another agent (a shopping agent delegating fare-finding to a travel agent). AP2 only enters the picture once a purchase decision has been reached: it governs the authorization and settlement of that specific transaction. In a diagram, draw AP2 as a distinct horizontal layer that agent-to-agent and agent-to-tool traffic drops into whenever a "pay for this" decision fires — not as a parallel path to MCP/A2A, but as a gate the transaction passes through.

The Mandate chain: Intent → Cart → Payment

AP2's core mechanism is three signed Mandates, each carried as a W3C Verifiable Credential. Each mandate cryptographically references the one before it, so the chain can be audited end to end by any party that receives the final charge.

Intent Mandate

Issued when the user grants the agent bounded authorization to shop or act — for example, "book a round-trip flight to Denver under $450, departing after the 10th, no red-eyes," or "reorder my usual grocery basket weekly, up to $120." The Intent Mandate encodes hard constraints: spend ceiling, category, expiry, and any merchant allow/deny list. This is the boundary within which the agent can act autonomously without going back to the human.

Cart Mandate

Once the agent (or a merchant agent it negotiates with) has selected specific line items, it issues a Cart Mandate — the exact cart contents, price, and merchant, cryptographically tied back to the Intent Mandate that authorized it. This is the proof that the specific purchase falls within what the user actually agreed to, not just a generic "the agent was allowed to spend money" claim.

Payment Mandate

The final signed authorization sent to the payment network or processor to actually move funds, referencing the Cart Mandate it settles. The payment network or issuer can verify the full chain — Intent → Cart → Payment — before clearing the charge, giving it proof of authorization comparable to (or stronger than) a card-present human transaction.

Human-in-the-loop checkpoints

Not every purchase should be fully autonomous. AP2 architectures typically define a threshold inside the Intent Mandate: purchases within the mandate's bounds (amount, category, merchant) settle without further human input, while anything that would exceed the bound — a higher price, an unlisted merchant, a expired mandate — triggers a step-up approval request back to the human before a Cart or Payment Mandate is issued. Show this explicitly as a decision diamond in your diagram: "within Intent Mandate bounds?" with one path continuing straight to Cart Mandate negotiation and the other routing to a human-approval UI.

Payment rails AP2 can settle over

AP2 is rail-agnostic by design — the Payment Mandate is a wrapper that can be fulfilled by whichever settlement method the merchant and user support:

• Card networks: Mastercard and American Express are launch partners with native Payment Mandate support
• ACH / bank transfer: for larger consumer or B2B payments where card interchange fees don't make sense
• Real-time payment rails: FedNow, UPI, and Pix for instant settlement in supported regions
• Stablecoins and digital assets: Coinbase and MetaMask have shipped stablecoin extensions so USDC can settle a Payment Mandate as a first-class rail alongside cards, not a bolt-on

In a diagram, show the payment processor/network as a component that branches to multiple rail adapters, with the Payment Mandate as the single input contract regardless of which rail actually clears the funds.

AP2 vs. UCP vs. ACP: the three-protocol commerce stack

AP2 doesn't operate alone. Three complementary standards have emerged for agentic commerce, each covering a different phase of the transaction — they stack together rather than compete:

In practice, a shopping agent uses UCP-style discovery to find and build a cart, ACP-style checkout to execute the purchase flow inside a chat or app surface, and AP2 mandates underneath both to prove the user actually authorized the spend and to carry the payment authorization to the network. Diagram them as three layers a transaction passes through, not three competing boxes.

Core AP2 architecture components

• User agent (with wallet/credential store): holds the user's signing keys and the Intent Mandates the user has issued, and requests approval when a purchase exceeds a mandate's bounds
• Verifiable Credential issuer/verifier: issues signed mandates and lets any downstream party (merchant, processor, issuer) verify the chain without contacting the user directly
• Merchant agent / storefront API: negotiates the Cart Mandate — confirming price, availability, and fulfillment terms with the requesting agent
• Payment processor/network: receives the Payment Mandate, verifies the mandate chain, and routes to the selected rail (card, ACH, real-time, or stablecoin)
• Human-approval checkpoint: a UI or notification surface the agent calls out to when a transaction falls outside Intent Mandate bounds

Prompt templates for AP2 architecture diagrams

Autonomous shopping agent with AP2 authorization

B2B agent-to-agent procurement with stablecoin settlement

What to show in your AP2 architecture diagram

• The Mandate chain: Intent → Cart → Payment drawn as a single, visually distinct flow separate from ordinary MCP tool calls or A2A delegation traffic
• Verifiable Credential issuer/verifier: shown as a component every mandate passes through for signing and later verification by merchant, processor, and issuer
• Human-approval checkpoints: a decision point showing when a transaction is within Intent Mandate bounds (autonomous) versus when it requires step-up human approval
• Payment rail selection: the branch point where a Payment Mandate routes to card, ACH, real-time rail, or stablecoin settlement
• Trust boundary vs. the agent layer: a clear line between MCP/A2A agent-reasoning traffic and the AP2 authorization/payment layer beneath it
• Audit trail: where signed mandates are persisted for compliance, dispute resolution, and chargeback evidence

Related guides: A2A protocol architecture diagrams, MCP architecture diagram, AI agent architecture diagrams, and securing agentic AI systems.