Zero-Trust Agent Models: Protecting User Data in UCP

The Paradigm Shift: From Network Zero-Trust to Transactional Zero-Trust

As we transition into the era of agentic commerce, the traditional security perimeters of firewalls and encrypted tunnels are no longer sufficient. When an autonomous agent powered by Google Gemini acts on behalf of a user to purchase products from Google Merchant Center, the security model must shift from protecting the connection to protecting the intent. This is the core of Zero-Trust AI Commerce.

In the Universal Commerce Protocol (UCP), we operate under the assumption that every component is potentially compromised or capable of hallucination. Whether it is the Large Language Model (LLM), the Model Context Protocol (MCP) server, or the third-party merchant endpoint, trust is never granted by default. Every action—from checking inventory to final settlement via Google Pay—must be verified through a series of cryptographic proofs and time-bound authorizations.

The Core Pillars of UCP Security

UCP’s zero-trust architecture is built upon three foundational pillars designed specifically for the developer ecosystem integrating Google Cloud and AI tools.

1. Identity Linking and OAuth 2.0

Before an agent can perform any high-risk action, such as accessing a user’s saved shipping preferences or initiating a checkout via Native Checkout, it must establish a secure link between the user’s Google Identity and the UCP session. By leveraging OAuth 2.0, UCP ensures that the agent never sees the user’s primary credentials. Instead, it operates using scoped tokens that limit the agent’s reach to specific commerce-related metadata.

2. Micro-Segmentation of Agent Capabilities

Using the Model Context Protocol (MCP), developers can isolate the tools available to an agent. For example, a ‘Search Agent’ may have access to Google Merchant Center product feeds but is strictly forbidden from accessing the payment gateway. This prevents ‘privilege escalation’ where a simple product inquiry could be manipulated into an unauthorized transaction. In UCP, the ‘Checkout’ tool is a high-privilege resource that requires a separate layer of validation known as the AP2 mandate.

3. Continuous Real-Time Risk Signals

UCP integrates directly with Google’s Risk Signals. If an agent attempts to initiate a purchase from an unrecognized device or a suspicious IP range, UCP can trigger a step-up authentication. This ensures that even if an agentic workflow is compromised at the software level, the protocol halts the transaction before funds are moved.

Understanding Signed Mandates and AP2

The centerpiece of Zero-Trust AI Commerce within UCP is the Agent Payment Protocol (AP2). In a standard web checkout, the user clicks a ‘Buy’ button, which is a binary signal of intent. In agentic commerce, the ‘intent’ is often generated by an AI. To bridge this gap securely, UCP introduces Signed Mandates.

How AP2 Functions

When an agent (e.g., a Gemini-powered personal shopper) identifies a product to purchase, it does not call the ‘pay’ function directly. Instead, it generates a Proposed Transaction Object. This object includes:

• Product SKU: Verified against the Google Merchant Center feed.
• Price Ceiling: The maximum amount the agent is authorized to spend.
• Expiration: A short TTL (Time-To-Live) for the authorization, typically 5-10 minutes.
• Merchant ID: The cryptographically verified identity of the seller.

The user must then provide a ‘Signed Mandate’—typically through a biometric prompt on their device or a secure UI overlay. This mandate is a cryptographic hash of the transaction details signed with the user’s private key. UCP verifies this signature against the user’s public key before the transaction is processed by Google Pay. This ensures that even if an agent ‘decides’ to buy a more expensive item, the transaction will fail because the signed mandate only covers the original price ceiling.

Data Minimization in Agentic Workflows

A primary concern for developers building with Gemini is the exposure of PII (Personally Identifiable Information) to the LLM. If an agent knows the user’s full credit card number and home address, that data exists within the model’s context window, creating a massive leakage risk.

UCP solves this through extreme data minimization. The protocol uses Ephemeral Data Pointers. Instead of passing the full delivery address to the agent, UCP passes a ‘Shipping Token’ or a localized ‘Eligibility Signal’ (e.g., verifying if the user is in a region that requires California Prop 65 warnings). The actual address is only revealed to the Merchant of Record at the moment of shipping label generation, bypassing the agent’s memory entirely.

Native vs. Embedded Checkout Security

UCP supports two primary checkout paths, each with different security implications for zero-trust:

• Native Checkout: The agent hands the transaction off to the Google Pay API. The merchant never sees the raw payment data, and the agent only receives a ‘Success’ or ‘Failure’ signal. This is the gold standard for zero-trust as it minimizes the attack surface.
• Embedded Checkout: The agent interacts directly with the merchant’s webhooks or REST API. In this scenario, UCP enforces strict JSON-RPC validation to ensure the agent is not injecting malicious payloads into the merchant’s backend.

Implementing Zero-Trust with Google AI Mode

For developers using Google AI Mode to build shopping extensions, the implementation of zero-trust begins at the prompt engineering and tool-definition level. When defining tools for Gemini via MCP, developers should utilize ‘System Instructions’ that reinforce the boundary of the agent. However, because system instructions can be bypassed via prompt injection, UCP provides a hard-coded validation layer.

// Example UCP Validation Logic for an Agentic Request
if (request.amount > userProfile.max_agent_spend) {
  throw new SecurityError('Transaction exceeds pre-authorized limit.');
}
if (!verifySignature(request.mandate, userPublicKey)) {
  throw new SecurityError('Invalid or missing AP2 Signed Mandate.');
}

This code illustrates that the protocol does not trust the agent’s logic. Even if the LLM believes it is authorized to spend $500, the UCP middleware checks the user’s pre-set limits and the cryptographic validity of the mandate before reaching out to Google Pay.

Conclusion: The Future of Secure Autonomy

Zero-Trust AI Commerce is not about limiting the power of agents; it is about providing the safety rails that allow them to be truly useful. By implementing UCP’s signed mandates, leveraging the Model Context Protocol for tool isolation, and utilizing Google’s robust identity and payment infrastructure, developers can build agentic experiences that are both frictionless and unhackable. As the ecosystem grows, the ability to prove user intent through AP2 will become the standard for every transaction in the autonomous economy.