Verifiable intent is the cryptographic mechanism by which an AI agent proves it has legitimate authorization from a human user to conduct a specific transaction — with defined scope, expiration, and revocation capabilities.
In agentic commerce, the fundamental trust question is: how does a merchant know that an AI agent requesting a $500 purchase actually has permission from a real human to spend that money? Verifiable intent answers this question without requiring the human to be present at the moment of transaction.
How Verifiable Intent Works
The architecture uses public key infrastructure (PKI) — the same cryptographic foundation that secures HTTPS connections and digital signatures. For how this ties to network partners, see verifiable intent architecture for agentic commerce. The flow works like this:
- The user grants authorization. Through their AI agent interface (ChatGPT, Google AI Mode, etc.), the user defines what the agent can do: purchase categories, spending limits, approved merchants, and time windows.
- A signed credential is generated. The authorization is encoded as a digitally signed document — a cryptographic proof that includes the scope of permission, expiration date, and the user’s verified identity (without exposing personal data to the merchant).
- The agent presents the credential at checkout. When the agent initiates a purchase, it presents this signed credential to the merchant. The merchant can verify the signature’s authenticity without contacting the user directly.
- The merchant validates. The merchant checks: Is the signature valid? Is the credential expired? Does the purchase fall within the authorized scope? Has the credential been revoked?
Privacy by Architecture
Customer data ownership in UCP pairs with verifiable intent designed with privacy as a structural property, not an afterthought. The credential proves authorization without revealing unnecessary personal information. A merchant doesn’t need to know the user’s name to verify that an agent has valid spending authority. The cryptographic proof confirms: “this agent has permission to spend up to $X on category Y before date Z” — nothing more.
This approach aligns with the data minimization principles embedded in GDPR and emerging AI commerce regulations. The agent presents exactly the claims needed for the transaction and nothing else.
The Trust Triangle
Verifiable intent creates a three-party trust model:
- User → Agent: The user trusts the agent to act within the authorization scope. If the agent exceeds its scope, the credential won’t validate.
- Agent → Merchant: The agent presents cryptographic proof. The merchant can verify without trusting the agent’s self-reported claims.
- Merchant → Payment Network: Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay both implement PKI-based verification, adding the payment network as a trust anchor.
Scope Limitations and Revocation
Credentials include explicit constraints: maximum transaction amount, allowed merchant categories, geographic restrictions, and expiration timestamps. Users can revoke authorization at any time, and the revocation propagates to merchants through the protocol’s credential verification layer.
This is architecturally different from a stored credit card, where revocation requires contacting the card issuer. In verifiable intent, revocation is built into the protocol itself.
Verifiable Intent vs. Traditional Authorization
Every online payment today runs on authorization models built for humans at keyboards. Verifiable intent replaces them with a model built for agents acting alone.
A stored credit card says: this merchant may charge this account, more or less whenever, until someone notices and calls the bank. Revocation is a phone call. Scope is whatever the merchant decides to attempt.
An OAuth token says: this app may act as this user within these scopes, until the token expires or the user finds the settings page. It was designed for apps with human operators, not autonomous agents negotiating purchases.
3D Secure says: pause the transaction and make the human prove they’re present. It works by re-inserting the human into the loop — the exact thing agentic commerce removes.
Verifiable intent says: this agent may spend up to $X on category Y with merchant Z before date W, and here’s the cryptographic proof. The scope lives inside the credential itself, not in a database somewhere. Revocation is a protocol operation, not a customer service call. And verification happens without waking the human up.
The Credential Lifecycle
Issuance. The user defines the authorization — amount caps, merchant categories, time windows — through their agent interface. The credential is signed with the user’s private key and handed to the agent. The user never shares the key itself.
Presentation. At checkout, the agent submits the credential alongside the order. The merchant receives a signed document, not a card number.
Verification. The merchant or payment network checks four things: the signature is valid, the credential hasn’t expired, the purchase falls within the authorized scope, and the credential hasn’t been revoked. All four checks are cryptographic or protocol-level — no human judgment required.
Expiry and revocation. Credentials carry explicit expiration timestamps. Short-lived credentials for a single transaction expire on their own. Longer-lived ones can be revoked by the user at any time, with revocation propagating through the protocol’s verification layer to every merchant.
Failure Modes: When Verification Fails
Expired credential. The timestamp passed. The merchant declines the transaction the same way it would decline an expired coupon — cleanly, with a reason code the agent can report back to the user.
Revoked credential. The user pulled authorization mid-flight. Verification fails at the revocation check. The agent stops and tells the user what happened instead of retrying blindly.
Scope violation. The agent tried to spend $600 on a $500 credential, or bought from a merchant outside the approved category. The credential is valid but the transaction isn’t covered. This is the failure mode that separates verifiable intent from stored cards — a stored card would have just charged.
Invalid signature. The credential was tampered with or forged. Verification fails at step one, and the merchant treats it as hostile rather than erroneous.
Each failure mode produces a machine-readable reason, which is the whole point: the agent can explain to the user exactly why the purchase didn’t go through and what to change.
Related Reading
- What Is Agentic Commerce?
- AI Agent Verification for Merchants
- Visa vs Mastercard Compliance Race
- How AI Shopping Agents Work
Leave a Reply