AP2 proves the mandate. It doesn't prove the human.
The Agent Payments Protocol is becoming the way AI agents pay — backed by Google, donated to the FIDO Alliance, 60+ partners including Mastercard, PayPal, and Amex. Its Mandates are cryptographically signed. But a signed mandate proves a key signed it, not that a live, unique, real human did. That's the gap.
What AP2 gets right
AP2 (Agent Payments Protocol) gives agentic commerce a shared language for authorization: Mandates — Intent, Cart, and Payment — expressed as signed W3C Verifiable Credentials. A human (or their agent) signs a mandate describing what may be bought, and downstream parties can verify it. It's an open standard, now under FIDO Alliance governance, with serious distribution behind it. If you're building agent payments, you should build to AP2.
The gap AP2 leaves open
A signature proves that a key signed. It does not prove that a live, unique, real human was present and consenting at the moment of signing. A mandate can be signed by a key sitting on a compromised device, by a session a deepfake talked someone into approving, or by an automated flow with no human in it at all. AP2 deliberately leaves "is there a real person here?" to the issuer of the credential. That's the right design — and it's exactly the slot the next wave of fraud aims for, because a signed-but-not-human mandate looks identical to a real one.
Fill it with human presence
Issue the mandate behind a passkey ceremony with liveness, bound to a uniquely enrolled human. The result is still a valid AP2 mandate — same format, same verifiers, same rails — but now it carries an anti-deepfake guarantee: a specific, live person authorized this. You're not competing with AP2; you're the human-presence issuer inside it. Since AP2 lives under FIDO and the ceremony is WebAuthn-native, the two fit without translation.
Honest limits
Liveness raises the bar dramatically but isn't a theoretical absolute, so keep accessible fallbacks (hardware key, device PIN) and enroll uniqueness at onboarding. AP2 itself is young and evolving; building the human-presence layer as a clean, standard-native add-on — rather than a fork — is what keeps you compatible as it matures.
Frequently asked questions
Does this compete with AP2? No. AP2 defines the mandate; this issues the mandate behind a live-human ceremony. The output is a standard AP2 credential with an added human-presence guarantee.
Why isn't a signed mandate already enough? Because a signature proves possession of a key, not the presence of a live, unique human. A compromised device or a deepfake-approved session produces a valid-looking signature too.
How does this relate to passkeys / FIDO? It's built on them. The human-presence ceremony is a WebAuthn assertion with liveness; AP2's move under the FIDO Alliance makes the two natively compatible.
AP2 answers ‘what was authorized.’ It doesn't answer ‘by whom, and were they real.’ That second question is the whole game.