# Verifiable Intent
source: https://developer.mastercard.com/mastercard-agent-pay/documentation/verifiable-intent/index.md

Verifiable Intent enables a cardholder to securely authorize an Artificial Intelligence (AI) Agent to make purchases on their behalf. It creates a verifiable record of the cardholder's approval, allowing participants across the payment ecosystem to confirm that the Agent acted within the cardholder's authorized instructions.

By providing a transparent and trusted record of delegated authority, Verifiable Intent helps support secure, auditable, and fraud-resistant agentic commerce transactions.

Verifiable Intent supports:

* Verification of a cardholder's delegated purchasing authority.
* Validation that purchasing instructions have not been altered.
* Selective sharing of information, so participants can verify specific conditions without exposing sensitive details.
* Both immediate purchases and delegated purchasing experiences.

## Credential Layers {#credential-layers}

Verifiable Intent uses three linked credential layers to create a verifiable record of identity, authorization, and transaction execution.

|    Layer     |        Role         | Signed by  |                                                                                                                                                                           Description                                                                                                                                                                           |
|--------------|---------------------|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Layer 1 (L1) | Identity layer      | Mastercard | The identity layer establishes the verified payment credential using a Selective Disclosure JSON Web Token (SD-JWT) issued by Mastercard. The SD-JWT binds a tokenized payment credential to the cardholder's public key, creating a trusted link between the cardholder and the payment credential.                                                            |
| Layer 2 (L2) | Authorization layer | Cardholder | The authorization layer represents the cardholder's approved purchasing authority. Depending on the use case, it may contain: • A **closed mandate** that specifies the final purchase details for immediate transactions. • An **open mandate** that defines spending conditions, purchasing constraints, and delegated authority for autonomous transactions. |
| Layer 3 (L3) | Execution layer     | Agent      | The execution layer contains the finalized order generated by the Agent after operating within the purchasing conditions and constraints defined by the cardholder in Layer 2. This layer applies only to autonomous transactions.                                                                                                                              |

## How Verifiable Intent Works {#how-verifiable-intent-works}

Verifiable Intent creates a trusted record of a purchase using linked SD-JWT credentials. It allows participants to verify:

* The cardholder's approval.
* The delegated purchasing authority.
* The actions taken by the AI Agent to complete the transaction.

## Supported Agentic Commerce Models {#supported-agentic-commerce-models}

Verifiable Intent supports two purchasing models that differ based on the level of authority delegated to the Agent.

### 1. Immediate Purchase {#1-immediate-purchase}

In an Immediate Purchase flow, the Agent prepares a purchase for the cardholder, who reviews, approves, and authenticates the transaction before payment is completed.

**Credential Layers**: Identity (L1) and Authorization (L2)

**Example**:
The following example shows how an AI agent completes a card payment on a cardholder's behalf from card enrollment and product selection to authentication, payment authorization, and final order confirmation.

A cardholder enrolls a payment card and receives the required credentials. The cardholder then asks the Agent to purchase a tennis racket within a specified budget. After selecting a suitable product, the Agent requests payment credentials. The cardholder reviews and authenticates the payment, after which the merchant processes the transaction and confirms the order.
Diagram immediate-verifiable-intent

For step-by-step instructions on implementing the Immediate Purchase flow, [View Tutorial](https://developer.mastercard.com/mastercard-agent-pay/tutorial/implement_agentpay_vi_immediate/index.md).

### 2. Autonomous Purchase {#2-autonomous-purchase}

In an Autonomous Purchase flow, the cardholder grants an Agent permission to make purchases within predefined spending limits and conditions. Once authorized, the Agent can complete a purchase without requiring additional cardholder approval, provided it stays within the approved constraints.

**Credential Layers**: Identity (L1), Authorization (L2), and Execution (L3)

**Example**:
The following example shows how an AI agent can securely complete a card payment on a cardholder's behalf, even when the purchase occurs at a later time.

A cardholder enrolls a payment credential and defines purchasing preferences, spending limits, and conditions. The Agent continuously searches for products that meet those requirements. When a suitable product is found, the Agent completes the purchase using delegated payment credentials within the cardholder's approved parameters. The merchant processes the payment and confirms the completed order without requiring the cardholder to re-authenticate.

Diagram autonomous-verifiable-intent

For step-by-step instructions on implementing the Autonomous Purchase flow, [View Tutorial](https://developer.mastercard.com/mastercard-agent-pay/tutorial/implement_agentpay_vi_autonomous/index.md).

## Choosing between Immediate and Autonomous Purchase {#choosing-between-immediate-and-autonomous-purchase}

The following table compares the two purchasing models supported by Verifiable Intent and highlights how purchasing authority is delegated in each approach.

|     Purchase Model Attribute      |                            Immediate Purchase                             |                                          Autonomous Purchase                                           |
|-----------------------------------|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|
| Cardholder involvement            | Reviews, approves, and authenticates the purchase before it is completed. | Approves purchasing authority in advance. No additional approval is required for qualifying purchases. |
| Purchase details at approval time | Known and approved before execution.                                      | Not known at approval time. Purchasing conditions and constraints are approved instead.                |
| Agent authority                   | Limited to a specific purchase.                                           | May make future purchases within approved constraints.                                                 |
| Identity Layer (L1)               | Required                                                                  | Required                                                                                               |
| Authorization Layer (L2)          | Required                                                                  | Required                                                                                               |
| Execution Layer (L3)              | Not used                                                                  | Required                                                                                               |
| Merchant and product selection    | Defined before approval.                                                  | Determined by the Agent at execution time.                                                             |
| Consumer authentication           | Required before payment execution.                                        | May not be required at the time of purchase, depending on the transaction flow.                        |
| Best suited for                   | Assisted purchases where the cardholder approves the final transaction.   | Delegated purchases where the Agent can act on the cardholder's behalf within approved parameters.     |
| Example use case                  | Purchase this tennis racket for $100.                                     | Find and purchase a tennis racket under $100 when one becomes available.                               |

## Intent Registration {#intent-registration}

The current Verifiable Intent implementation requires submission of the complete credential chain in a single Intent registration request.

During registration:

* All required SD-JWT layers must be assembled before submission.
* The complete chain of trust is provided to Mastercard in one request.
* Incremental or multi-stage registration of individual credential layers is not supported.

This ensures that Mastercard receives the full, verifiable record of identity, authorization, and execution context for the transaction at the time of registration.

## Verifiable Intent Lifecycle {#verifiable-intent-lifecycle}

Verifiable Intent provides proof that a cardholder has authorized an agent to act on their behalf.

The lifecycle consists of the following stages. The sequence and timing may vary depending on the implementation.

|            Stage             |                                                                                                                   Description                                                                                                                    |
|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Establishment**            | The Cardholder and Agent define the scope of authority, including purchase instructions, spending limits, validity periods, approved Merchants, and other applicable constraints.                                                                |
| **Affirmative Confirmation** | The Cardholder reviews the Intent and provides clear, voluntary, active, and informed confirmation of the authority being granted to the Agent.                                                                                                  |
| **Authentication**           | The Cardholder is authenticated in accordance with applicable program and Token Authentication Framework (TAF) requirements.                                                                                                                     |
| **Registration**             | The Intent is registered through the applicable Mastercard services and made available for validation, checkout, and execution.                                                                                                                  |
| **Lifecycle Events**         | The Intent can be replaced, revoked, canceled, consumed, expire, or otherwise become unavailable for future use.                                                                                                                                 |
| **Execution**                | The Agent registers the final order details and uses the approved authority to complete one or more permitted purchases.                                                                                                                         |
| **Verification**             | An authorized participant, such as the Agent, Merchant, PSP, Acquirer, or Mastercard, can verify that a transaction is consistent with the approved Intent at checkout, execution, authorization, or another point in the transaction lifecycle. |
| **Post-Transaction Events**  | Participants can exchange Intent and transaction information to support order status notifications, customer service, transaction recognition, dispute prevention and resolution, and operational investigations.                                |

## Managing Intent Changes {#managing-intent-changes}

An Agent can act only within the scope and validity period defined in an approved Intent.

If the Cardholder's approved purchasing authority changes materially, the existing Intent cannot be updated. A new Intent must be created and approved before the Agent can continue acting on the revised authority.

To establish a replacement Intent:

1. Create a new Intent reflecting the updated purchasing authority.
2. Obtain a new Affirmative Confirmation from the Cardholder.
3. Re-authenticate the Cardholder.

The Agent can act on the revised authority only after all required approval and authentication steps are completed.

## Next Steps {#next-steps}

Now that you understand Verifiable Intent and the supported use cases, explore the [API Reference](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#verifiable-intent) section to review the available endpoints and interact with them in the API Explorer.