How do I let an AI agent purchase on my behalf?

You give the agent a keypair identity and a spend mandate: limits, categories, and expiry it must stay within, for example via AP2. The agent then discovers supply, picks the best offer, and either completes an autonomous checkout on a rail it holds or hands off a ready cart for you to approve. Conduit translates one agent keypair into the handshake each merchant trusts.

Is autonomous agent checkout safe, and who holds the money?

Conduit never holds or delays funds. It is not a marketplace, merchant of record, or money transmitter. Spend stays inside the mandates you set, payment goes directly from the buyer instrument to the merchant, and every order has paths to review, dispute, chargeback, or human takeover.

Do agent purchases still need human approval?

Only as much as you want. You set mandates once; within them the agent transacts autonomously. When a merchant requires a human step, or the agent lacks authority, Conduit hands off a ready checkout for a person to finish, and a human can step in at any time.

What is AP2 and how do agent spend mandates work?

AP2 (Agent Payments Protocol) lets a human approve a spend mandate once, covering limits, categories, and expiry, that an agent then transacts within. Conduit translates a single agent keypair into the mandate each merchant trusts, so autonomous payments stay inside boundaries you control and can revoke instantly.

Guide

Agent spend limits: how AP2 mandates keep autonomous checkout safe

An agent purchase limit is a human-approved spend mandate: maximum per order, monthly cap, allowed categories, and an expiry. The agent may pay autonomously only inside that envelope. Outside it, checkout falls back to a human handoff.

On Conduit, mandates follow the AP2 (Agent Payments Protocol) pattern. You approve once on a trusted surface, and Conduit never holds the money: payment goes from your instrument to the merchant.

The direct answer

To let an AI agent purchase on your behalf without approving every cart: give it an identity, then a mandate with limits. The agent discovers supply and can complete checkout only when the offer fits the mandate and a rail it holds.

Four scope fields: max per order, monthly cap, categories, and expires. Anything that grants more spending power than the human last approved goes back to a human.

What counts as widening

Narrowing a mandate applies immediately. Widening always needs re-approval, and the definition of widening has one edge worth knowing, because it is the one people get wrong.

Raising a cap is widening. Obviously.
Removing a cap is also widening. An absent cap means no limit, not zero. Clearing the max-per-order field on a $50 mandate asks for unlimited per-order spend, so it goes back to a human rather than applying silently.
Extending the expiry is widening.
Loosening the category allowlist is widening. Adding a category grants real new spending power, and clearing the list entirely means every category, which is the largest widening available.

How categories route

Categories are an enforced allowlist drawn from the Google Product Taxonomy, level 1: the 21 official top-level categories, with their real taxonomy ids. That vocabulary is deliberately not a Conduit invention, so the values keep working as merchant catalogs start carrying their own category data.

When an offer needs paying, search and checkout pick the most specific live mandate that names the offer’s category. If no mandate names it, they fall back to mandates that restrict no categories at all. There is no fallthrough from a spent specific envelope back to the general one: if your Electronics mandate is exhausted, the order does not quietly land on the general mandate instead.

Mandates that name categories fail closed. An offer Conduit could not classify is treated as outside the allowlist rather than waved through. The two outcomes stay distinct on the wire, because they mean different things: category_unknown is a Conduit coverage problem, category_not_in_mandate is a genuine scope violation.

What a mandate covers, and what it does not

A mandate authorizes spend policy, not custody. Conduit is not a marketplace, merchant of record, or money transmitter. Card numbers stay off Conduit’s wire, and you approve the policy, not a shared secret.

Covers: whether autonomous checkout is allowed for this agent on in-scope offers.
Does not cover: inventing funds, holding settlement, or bypassing merchant checkout rules.
Still available without a mandate: discovery, comparison, and handoff, where a human finishes on continue_url, which forwards to the merchant.
Missing or exhausted coverage is a handoff, not a hard stop. The order does not fail; it routes to a human with the reason attached.

The Conduit flow

After your agent connects over MCP:

Call payment_mandate with action=request and scope (limits, categories, expiry).
Status starts as PENDING_HUMAN_APPROVAL. Open the returned approval_url on a trusted device, or approve it in Hub. There is no approve API to call, by design: an agent cannot approve its own mandate.
Re-run supply_search with agent_id. Offers you can pay now show badge payable_now and action execute_autonomous.
Use payment_mandate with action=list|update|revoke. Ownership is enforced, so mandate_forbidden comes back if the wrong agent tries.

What the payable_now badge means

payable_now is evaluated with the same covering-mandate selection and scope check that order_execute uses, so a badge in search results reflects the checkout that would actually run. It accounts for caps, spend already used this window, and categories, not merely for the existence of an active mandate.

One case still resolves to handoff regardless of your mandate: an offer priced in a currency with no comparable USD amount cannot be compared to a USD cap, so it is not autonomous. That is deliberate. A cap you cannot evaluate is not a cap.

When you can skip mandates

Mandates unlock autonomous pay. They are optional for browsing and for handoff checkout. If you only need ranked offers and a ready cart link, connect the agent and search, then finish as a human.

Set the limits when you want unattended restocks or scheduled buys. Pipes run standing jobs on that footing, and the job runs as an agent under that agent’s permissions and mandate. For the whole loop, see how agentic checkout works.

Approve a mandate in Hub Jobs that run under those limits

Frequently asked questions

How do I let an AI agent purchase on my behalf?: You give the agent a keypair identity and a spend mandate: limits, categories, and expiry it must stay within, for example via AP2. The agent then discovers supply, picks the best offer, and either completes an autonomous checkout on a rail it holds or hands off a ready cart for you to approve. Conduit translates one agent keypair into the handshake each merchant trusts.
Is autonomous agent checkout safe, and who holds the money?: Conduit never holds or delays funds. It is not a marketplace, merchant of record, or money transmitter. Spend stays inside the mandates you set, payment goes directly from the buyer instrument to the merchant, and every order has paths to review, dispute, chargeback, or human takeover.
Do agent purchases still need human approval?: Only as much as you want. You set mandates once; within them the agent transacts autonomously. When a merchant requires a human step, or the agent lacks authority, Conduit hands off a ready checkout for a person to finish, and a human can step in at any time.
What is AP2 and how do agent spend mandates work?: AP2 (Agent Payments Protocol) lets a human approve a spend mandate once, covering limits, categories, and expiry, that an agent then transacts within. Conduit translates a single agent keypair into the mandate each merchant trusts, so autonomous payments stay inside boundaries you control and can revoke instantly.