Signed power of attorney for AI agents — machine-verifiable, rail-agnostic, liability-clear
AI agents purchase on behalf of humans. But who is liable when the agent orders wrong? Who checks the budget? Who stops a manipulated order? Today there is no standard for this.
No protocol defines who is responsible when an agent makes erroneous transactions.
Agents can act beyond the authorized budget — no on-chain check possible.
A manipulated merchant can lure the agent into unauthorized purchases.
A signed mandate defines exactly what the agent may do: which merchant, which category, which budget, how many orders, which time window. Before every charge, a verifier checks automatically — no transaction without valid authorization.
| Situation | Decision | Liability |
|---|---|---|
| Mandate signature invalid | REJECT | None (never charge) |
| Agent not authorized / Attestation invalid / Replay | REJECT | Agent operator |
| Order outside constraints (budget, merchant, category) | REJECT | Agent operator |
| Order within constraints | APPROVE | Principal (normal purchase) |
From SDK to blockchain — the same verifier runs everywhere.
Create, sign, verify mandates. Pure functions, no I/O. Runs in Node.js, Deno, browser and edge workers.
Escrow, Ed25519 introspection, reputation tracking. PDA-based, no upgrade key after audit.
x402 (HTTP-native), Google AP2, Mastercard Verifiable Intent, Visa TAP (planned). Same verifier, every rail.
Principal, agent and merchant sign cryptographically. Forgery computationally impossible.
On-chain CPI attacks blocked. The verifier checks the signature directly in the Ed25519 precompile.
Attestation hash prevents replay of intercepted transactions.
No plaintext on chain or at the merchant. Only a SHA-256 hash as evidence.
Cumulative budget across multiple orders. On-chain state, tamper-proof.
Mandates expire. No transaction possible outside the signed time window.
The prompt contains personal intentions, preferences and context. Sending it to the merchant or the blockchain would be a privacy disaster — personal data, purchase behavior and intentions would be permanently publicly accessible.
Only a SHA-256 hash of the prompt is transmitted — as cryptographic evidence for disputes. The verifier checks constraints, not intentions. Privacy by design.
Click one of the commands to test the verifier live.
{ "version": "1.0", "mandateId": "mnd_7f3a9c2b", "principal": { "publicKey": "Ed25519:4mXp...kR9z", "displayName": "Anna Müller" }, "agent": { "publicKey": "Ed25519:9nQr...mL2w", "name": "ShoppingAgent/v2" }, "constraints": { "allowedMerchants": ["merchant.kaffeeshop.at"], "allowedCategories": ["food_beverage", "grocery"], "budgetTotal": 50.00, "currency": "EUR", "maxOrdersPerDay": 3, "validFrom": "2026-10-20T00:00:00Z", "validUntil": "2026-10-27T23:59:59Z" }, "promptHash": "a3f7c2e1b8d4...", "signature": "Ed25519:7xKm...4pNq" }
{ "orderId": "ord_3a8f1c", "mandateId": "mnd_7f3a9c2b", "merchant": "merchant.kaffeeshop.at", "category": "food_beverage", "amount": 18.50, "currency": "EUR", "items": [{ "name": "Kaffee Speciality 250g", "qty": 1, "price": 18.50 }], "budgetUsed": 0.00, "timestamp": "2026-10-20T11:42:00Z", "attestation": "Ed25519:3zRt...8kWx" }
"constraints": { "type": "object", "required": ["budgetTotal", "currency", "validUntil"], "properties": { "allowedMerchants": { "type": "array", "items": { "type": "string" } }, "allowedCategories": { "type": "array", "items": { "type": "string" } }, "budgetTotal": { "type": "number", "exclusiveMinimum": 0, "description": "Max cumulative spend across all orders" }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$" }, "maxOrdersPerDay": { "type": "integer", "minimum": 1 }, "validFrom": { "type": "string", "format": "date-time" }, "validUntil": { "type": "string", "format": "date-time" } } }