Human-absent execution requires narrower mandates, stronger monitoring, and clearer recourse than final-step approval.
Why this question matters
AP2 distinguishes situations where a user approves a final cart from those where an agent acts later under a signed intent. The second model enables useful automation, but the agent must interpret changing prices, availability, sellers, and timing without a contemporaneous human decision.
That interpretation expands the attack surface. Several agents can shape the options so the final purchase technically satisfies the mandate while violating the user’s unstated expectations or market rules.
Signals worth observing
- A mandate uses broad qualitative terms with no resolution policy.
- The agent selects a related counterparty without renewed disclosure.
- Market conditions change materially between delegation and execution.
Practical control direction
- Define quantitative limits and prohibited counterparties.
- Require re-approval when context crosses a materiality threshold.
- Provide cancellation windows and evidence-backed dispute paths.
AgentCollusion lensGuardian Agents matter most when the principal is absent and automated relationships can reshape the decision space.
