“No liability shift exists yet.” That sentence is yours, published under your byline on Worldpay Insights, July 30, 2026. Nobody else in payments has said it that plainly. It is also the most useful sentence anyone in this market has written, because of what follows from it mechanically.
If no shift exists, then an agent dispute still has to land somewhere. It lands. Every one of them lands. And with no shift and no framework, it lands by default rather than by determination, on whoever is holding the exposure when the clock runs out. You are an acquirer. A lot of the time that is you, on behalf of a merchant who asked you to handle it.
Both of those receipt types are deployed in production and both run in your browser on this page. Sixteen runs in all, against open verify routes, and two of them come back valid false on purpose so you can watch the instrument refuse.
Nothing on this page argues that Worldpay missed anything. Every line in this section is a verbatim sentence from Agentic commerce liability is still being written, by Reshmi Suresh, Head of Agentic Commerce, published on Worldpay Insights and dated July 30, 2026 in the article’s own metadata. They are grouped by what they are about, because read together they describe an evidence gap rather than a policy gap.
“No liability shift exists yet.”Reshmi Suresh, Head of Agentic Commerce, Worldpay · Worldpay Insights, July 30, 2026
“But liability allocation between merchant, issuer and agent platform remains largely unresolved once a dispute moves past straightforward fraud.”Same article, key points · Worldpay Insights, July 30, 2026
“Where it gets murkier is everything short of outright fraud.” And: “Today’s frameworks don’t yet have a clean answer for who absorbs that.”Same article · Worldpay Insights, July 30, 2026
“There’s no framework yet for ‘I asked my agent to buy something inexpensive, and it bought something expensive instead.’”Same article, on Regulation E · Worldpay Insights, July 30, 2026
“Legal analysts tracking this space describe the allocation of that risk among issuer, acquirer, agent platform and merchant as still being negotiated in real time, with network rules setting a baseline but leaving real gaps for contractual terms, and eventually case law, to fill in.”Same article. Note the four named parties, and that the acquirer is one of them · Worldpay Insights, July 30, 2026
“Without a signed mandate proving what the shopper authorized, a disagreement between agent and shopper becomes a coin flip, and issuers tend to side with the cardholder.”Same article, under the heading “A dispute with no audit trail” · Worldpay Insights, July 30, 2026
“Without evidence tying the agent’s action to a specific authorized instruction, merchants have no way to challenge it.”Same article, under the heading “A false ‘my agent went rogue’ claim” · Worldpay Insights, July 30, 2026
Under the heading “Intent verification”, the article asks for “a record, ideally cryptographic, of what the shopper asked the agent to do, which becomes the evidence that matters most when a dispute happens.”Same article · Worldpay Insights, July 30, 2026
“Liability and dispute resolution doesn’t have a contract yet.” And, in the same paragraph: “only the card networks can close the liability gap at scale.”Same article, under “What’s still unsolved” · Worldpay Insights, July 30, 2026
“None of this gets solved by picking a side on which protocol wins. It gets solved by merchants and their PSPs building the fraud, identity and evidence layer underneath all of them.”Same article, closing line before the FAQ · Worldpay Insights, July 30, 2026
Two of those deserve to be read next to each other. A contract needs an object to be written against, and the article says the contract does not exist. Meanwhile the same article says the thing that closes the gap is an evidence layer built by merchants and their PSPs. That is the whole argument on this page, in your own two sentences: recovery.determination is the object a contract gets written against, and it sits in the evidence layer rather than in the rules.
One honesty note on dates. The article publishes datePublished of 2026-07-30 in its own structured data, so that is the date used throughout this page. If Worldpay considers the publication date to be July 31, the quotes are unaffected.
The issuer version of this problem is about paying a cardholder. The network version is about writing rules. Neither is your version. You sit between merchants and networks, you process the transaction, and you carry chargeback exposure on behalf of merchants who hired you precisely so they would not have to think about it. When an agent dispute arrives, it arrives at you, in a case file that somebody else assembled.
| What the party decides | What the party is missing | |
|---|---|---|
| An issuer | Whether to pay its cardholder, and how fast. | An independent record of the agent’s conduct. It holds the cardholder relationship and the fraud rules, so its finding is its own. |
| A network | The rules, the return codes and the baseline allocation. | Standing. It is a party to the scheme it would be ruling on, which is why your article says the gap is “still being negotiated in real time.” |
| An acquirer and processor | Whether to fight a chargeback, on what evidence, and who eats it if the fight is lost. | Anything in the case file that a third party can recompute. The agent’s side of the story sits with the agent platform, and the platform has no obligation to hand you a signed version of it. |
That is a description of position, not of quality. The four party design does real work and the issuer fraud rules do real work. Your own article says the fraud case is “reasonably well handled” and that is right. The residue is the part that is not fraud, and the residue is where an acquirer is structurally exposed: you are asked to represent a merchant in an argument about what an agent was told to do, using records held by everyone except you.
You have already built the detection half of this. “Our Ravelin-powered agent detection identifies agent transactions today, with scoring and dispute evidence capabilities expected to become increasingly important as agentic commerce matures,” per the same article. Detection answers which agent. Scoring answers how that agent behaves in general. Neither answers the sentence a dispute turns on, which is whether this specific outcome was caused by the conduct of this specific party. That sentence needs an attribution, and an attribution needs a signer who is not one of the parties.
One more thing that makes this yours rather than anyone else’s. The article notes that Worldpay sits across many merchants rather than one storefront, which is the same reason your agent reputation scoring works. It is also the reason a recomputable attribution is worth more in your hands than in a single merchant’s: the same instrument, the same table, applied consistently across a book, is what turns a set of one off arguments into a policy.
Take “No liability shift exists yet” literally for a moment, because it is worth taking literally. A liability shift is a rule that moves an outcome from one party to another on stated conditions. With no such rule for agent error, the outcome does not stop happening. It gets assigned by whatever happens to be true about the plumbing.
| How an agent dispute is resolved today | What decided it | What a determination would need |
|---|---|---|
| The issuer sides with the cardholder and the chargeback stands. | Who holds the customer relationship. Your article puts it plainly: “issuers tend to side with the cardholder.” | A record of whose precommitted rule the facts actually broke. |
| The merchant represents, wins some, loses some, and stops representing because case by case fighting costs more than the losses. | Economics of the representment queue, which your article names as “its own cost.” | An outcome that is a lookup rather than an argument, so the cost per case falls to the cost of a verify call. |
| Nobody pursues the agent platform, because there is no object to pursue it with. | The absence of a contract. Your words: “Liability and dispute resolution doesn’t have a contract yet.” | A settlement position between two named parties, taken from a table both committed in advance. |
The two instruments on this page that matter most to you map exactly onto the right hand column. fault.attribution decides which party’s conduct caused the outcome. recovery.determination maps that outcome to a settlement position between two named parties, using a table committed in advance. Both are deployed in production and both run below.
Worth being exact about the limit. Neither instrument creates a liability shift, and neither one is a rule. A shift is written by the schemes and by contract, and your article is right that the networks are the ones who can close it at scale. What these two do is supply the determination that a shift, or a bilateral contract, would otherwise have to guess at. A rule with no recomputable input is still a coin flip with better paperwork.
This table is not a reframing. The left column is your four bullets, quoted, from the same article. The right column is a receipt type that is deployed in production today, with its live run further down this page.
| Your exposure case, quoted | What the dispute actually turns on | The signed record |
|---|---|---|
| “A dispute with no audit trail.” “Without a signed mandate proving what the shopper authorized, a disagreement between agent and shopper becomes a coin flip, and issuers tend to side with the cardholder.” | Whether the summary the shopper confirmed is the same bytes as the order that reached the merchant, and whether the confirmation happened between the two. | intent.affirmation |
| “A false ‘my agent went rogue’ claim.” “Friendly fraud with a new excuse. Without evidence tying the agent’s action to a specific authorized instruction, merchants have no way to challenge it.” | Whose precommitted constraint the observed facts broke, recomputed rather than argued, with the constraint timestamped before the loss. | fault.attribution |
| “A ‘this isn’t what I wanted’ chargeback.” “The agent buys something the shopper doesn’t like, it isn’t returnable and the shopper disputes the charge instead.” | Whether the instruction was checkable at all before the purchase. Your Regulation E line is exactly this case: “I asked my agent to buy something inexpensive, and it bought something expensive instead.” | intent.verifiability, then mandate.conformance |
| “Good bot, bad bot confusion.” “Fraud tooling that can’t distinguish a verified shopping agent from a malicious script either blocks legitimate revenue or lets bad actors through.” | Whether the agent that transacted is the agent that was admitted, and whether the conduct fell inside a separation bound signed in advance. | admission.binding |
| The one you did not list, because there is no instrument in the market for it. You paid, or your merchant paid. What does the agreement with the platform say happens next? | What settlement position the outcome maps to, out of a table two parties committed before the loss instead of after it. | recovery.determination |
| And the afternoon where the two files disagree. Your record of what the agent was told, and the platform’s record, do not match, and neither side wants to open its books. | Whether the two sides of a settlement agree, compared at a named cursor without either side disclosing anything. | ledger.parity |
Seven receipt types, sixteen live runs, in the order of that table. Every one of them prints what it does not prove, taken verbatim from its own schema, and two of the sixteen come back valid false because the receipt they were handed was wrong. Read those two first if you only read two. A verifier that agrees with everything is not checking anything.
One boundary worth stating before the instruments start. None of this needs a card number, a token, a cart or a shopper identity. Every input is a digest, a commitment or an instant. If a receipt needed to read cardholder data, it would not be on this page, and the schemas enforce that rather than promising it. mandate.conformance runs a gate literally named NO_PAN.
Your article says the answer is not picking a protocol winner. Agreed, and the mapping below is built that way. Each row is an object that exists in a published specification, matched to the receipt type whose own stated scope covers it with no reinterpretation. Only rows scored as a direct match are shown.
| Object, from its own specification | Receipt type | What the type proves about it |
|---|---|---|
| Typed constraints in Verifiable Intent and in AP2, the two protocols your article names as pointing toward what an intent record could look like. Verifiable Intent spec, AP2 v0.2. | mandate.conformance | Comparison of one named transaction against the constraints of a delegated authority receipt signed before authorisation, with the outcome recomputed by the service rather than supplied by the caller. |
| Cart Mandate, Intent Mandate, Checkout Mandate and Payment Mandate in AP2, each described as cryptographic proof of authorisation. AP2 v0.2. | mandate.conformance beside authority.delegation | Chain containment for the mandate, and a per transaction comparison against it. Neither attests that the human authored the root grant, which is the join intent.affirmation carries. |
| Web Bot Auth signed requests and trusted agent registry entries, the mechanisms your FAQ names for verifying an agent at the merchant edge. Cloudflare Web Bot Auth. | admission.binding | The binding of the agent that transacted to the registration it entered under, with the conduct instant at or after admission and inside a signed maximum separation. |
| The Regulation E and Regulation Z error resolution clocks, the 10, 45 and 90 day windows and the 60 day and two billing cycle windows. The regulation your article says has no framework for agent misinterpretation. | sequence.attestation | Event order folded into a root, bracketed below by a public block hash and above by an RFC 3161 token, so the timeline is fixed against a time source outside every party. |
And one row that matters to you specifically because of where it leaves the exposure. The Agentic Commerce Protocol delegated payment specification defines no mandate, no signed receipt and no audit trail, and states that settlement, refunds, chargebacks and compliance remain with the merchant and their PSP, per the ACP payment spec. Read as an acquirer, that is a protocol assigning the residue to you in writing. Every receipt on this page applies the moment a participant in that flow wants evidence, and none of them requires the protocol to change.
What the mapping deliberately does not claim. It is a scope comparison, not a quality comparison. Verifiable Intent, AP2, Web Bot Auth and the network frameworks verify what they were built to verify, and they built it well. The rows above exist because each specification scoped its object narrowly and left the join, the recomputation or the arbiter unnamed. A protocol cannot appoint its own referee, and none of them tried to.
This is the one that answers your sentence about the coin flip. It allocates a loss among four roles, principal, agent_operator, acceptor and issuer, by recomputing which party’s own precommitted constraint the observed facts violated. It does not weigh blame, read intent, or decide a dispute. It checks whose stated rule the facts broke, and it says nothing when the answer is not there. Three cases run below against the open verify route.
The precedence rule is the part to read twice, because it is the part a representment case usually dies on. A precommitment only counts if it was committed strictly before the loss instant. The verifier computes a precedence_class of all_precommitments_precede_loss or some_precommitments_follow_loss, and it recomputes that from the timestamps rather than trusting the field. So nobody writes a rule after the loss and then points at it. Not the agent platform, not the merchant, and not you.
The attribution_class comes out as single_party, shared, no_violation_found or indeterminate, and ATTRIBUTED_ROLE_RECOMPUTE derives the role from which party’s precommitment the observations broke. Run the hindsight case below and watch it come back indeterminate. The precommitments in that body post date the loss, so the receipt names no party at all. That is the behaviour you want in an object you intend to put in front of a scheme, a regulator or an opposing platform, because the first thing any of them does is look for the case where it guessed.
Where this sits in your book. Your article says a rogue agent claim leaves merchants with “no way to challenge it” because nothing ties the agent’s action to an authorized instruction. This is the object that ties it, and the reason it survives contact with the other side is that you did not sign it. The signer is a non party observer. An attribution signed by the acquirer representing the merchant is an argument. The same arithmetic signed by someone with no position is something the other side has to answer.
What it does not prove, in plain words. It does not say the loss happened, that the observations handed in are complete, that any party acted with intent, that any legal duty was breached, or that any amount is owed. It does not resolve a chargeback, does not affect any right a consumer holds under Regulation E or Regulation Z, and creates no liability shift. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed which precommitted constraints the supplied observations violated, and which parties had made those precommitments before the loss instant. It does not attest that the loss occurred, that the observations are complete, that any party acted with intent, that any legal duty was breached, or that any amount is owed.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
“Liability and dispute resolution doesn’t have a contract yet,” per your article. A contract has to be written against an object. Fault attribution names the locus and stops there. This is the next step, and it is deliberately a small one: it turns an attribution into a settlement position between two named parties, by looking the outcome up in a table those parties committed before the loss. Three cases run below.
Two parties agree an allocation table in advance and commit its digest. Later, one verified fault.attribution receipt gets handed in. The service recomputes an attribution_outcome_key from that receipt, looks the key up in the committed table, and signs the resulting settlement_position of respondent_bears, claimant_bears, shared_position or no_position. The position is a lookup, so a caller cannot supply it, and SETTLEMENT_POSITION_RECOMPUTE is the gate that says so. That is the difference between a determination and a default.
ATTRIBUTION_INTEGRITY reverifies the referenced fault attribution receipt in full, every signature and every one of its own gates, on each mint and each verify. That is why this instrument is slower than its neighbours, and it is why the position is worth anything. ALLOCATION_PRECEDENCE then requires the table digest to have been committed strictly before the loss instant, and fails closed otherwise, so a table written once the loss is known produces no position at all.
Why an acquirer cares more than anyone. A per case argument costs a queue. A lookup against a table you already negotiated costs a verify call, and it produces the same answer every time for the same facts, which is the only thing that makes a policy out of a pile of individual fights. Run the none case below: an indeterminate attribution maps to no_position, and the receipt does not fill the silence. Party identifiers stay out of the signed body as keyed pseudonyms, so the object can be handed to a platform, a scheme or an insurer without naming either side.
What it does not prove, in plain words. It does not say any amount is owed, that anybody will pay, that the table is enforceable, or that a contract exists at all. Whether a position turns into money is decided by the agreement between the parties and by nothing on this page. It is not a liability shift and it does not resolve a chargeback. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed a settlement position between two named parties from one named fault attribution outcome and a precommitted allocation table whose digest was committed before the loss instant. It does not attest that any amount is owed, that any party will pay, that the allocation table is enforceable, or that any contract exists between the named parties. Whether the recomputed position entitles anyone to payment is decided solely by the parties' own agreement.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Your article asks for “a record, ideally cryptographic, of what the shopper asked the agent to do, which becomes the evidence that matters most when a dispute happens.” This is the narrow, checkable part of that record: the amount and the order the customer saw are the amount and the order that were transmitted, and the confirmation happened between the two. Two cases run below, one on screen and one spoken.
Two opaque records go in, one for what was shown and one for what was sent. The service digests each one separately and compares them at ARTIFACT_EQUALITY_RECOMPUTE, so equality is a real comparison rather than a restatement of a field the caller filled in. Then AFFIRMATION_ORDERING_RECOMPUTE requires the affirmation instant to fall strictly between presentation and transmission. An affirmation stamped at the same moment as the presentation fails, and so does one stamped at transmission. The mint path refuses to sign a body that falls outside the bracket at all.
All three instants are placed against an external time reference the operator declares, with a drift bound. TIME_REFERENCE_INTEGRITY recomputes the digest of that reference and DRIFT_BOUND_SATISFIED fails the receipt when observed drift runs past the bound the operator itself declared. The channel is recorded as interactive_display, voice_playback, messaging_thread or embedded_webview, so a spoken readback and an on screen confirmation stay distinguishable a year later, which matters when the dispute is about what the customer was actually shown.
The honest part, and it is the part worth saying out loud. This receipt says nothing about a person. It fixes bytes and order. What it removes is the gap between the summary a shopper confirmed and the order that reached the merchant, and that gap is the one thing nobody outside the agent platform can currently check. It is also the case with the least agent content in it, which is why it appears again in the section on ordinary traffic.
What it does not prove, in plain words. It does not say a human was there, that anyone read the summary, or that anyone understood it. It does not say the summary was a fair summary of what the person asked for. The channel and the time reference are recorded as declared and are not checked against the world. The boundary, verbatim from the schema. This receipt attests only that the digest of the artifact presented for affirmation equals the digest of the artifact transmitted as the authenticated intent, and that the affirmation instant falls strictly between the presentation instant and the transmission instant, with all three instants placed against a declared external time reference and drift bound. It does not attest that a human was present, that anyone read, understood, or agreed to anything, that the presented summary is a faithful summary of what any person said, that the affirmation was freely given, or that the presented artifact was rendered legibly. The channel and the time reference are recorded as declared and are not verified here.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Settlement between an acquirer and a counterparty comes down to two files that are supposed to agree. When they do not, somebody has to open their books, and neither side wants to. This compares the two sides without either one disclosing anything, and it refuses to say which side is right. The third run below is the one to read. It hands the verifier a receipt that labels a real disagreement as a match, and the verifier returns valid false.
Each side commits a keyed digest over the same declared list of fields, at a named cursor and a named instant, signed by its own registered attestor key. The service recomputes the comparison at COMMITMENT_EQUALITY_RECOMPUTE and returns match, divergence or window_exceeded. No balance, no holder, no account identifier and no field value enters the signed body, and NO_RAW_STATE_LEAK is a gate rather than a promise.
ATTESTOR_KEY_DISTINCTNESS refuses the obvious shortcut. One signer cannot produce both attestations, and the key that issues the receipt cannot also be named as an attestor, so nobody vouches for their own half. OBSERVATION_WINDOW_TOLERANCE and TIME_ANCHOR_DRIFT_BOUND then handle the case where the two snapshots were taken too far apart to compare, and the answer is window_exceeded rather than a false match.
Now the part that makes it usable between parties who do not trust each other, which is most of them. When the two records diverge, the receipt reports the divergence and refuses to say which one is right. It assigns no fault. Two adversaries can both sign up to an instrument that cannot be pointed at either of them, which is the only reason either of them would. And the fail run proves the refusal is real: relabel a divergence as a match and COMMITMENT_EQUALITY_RECOMPUTE fails the receipt.
What it does not prove, in plain words. It does not say either committed digest is a correct digest of the record it names, because checking that needs read access this receipt does not grant. It does not decide which side is right when the two disagree, allocates no fault, and settles or reverses nothing. A window_exceeded outcome means only that the two observations were too far apart to be decisive. The boundary, verbatim from the schema. This receipt attests that two named records, each observed at a named cursor and at a named instant, and each committed by a distinct registered attestor key to a keyed digest computed over the same declared list of fields, produced the comparison outcome that this service recomputed from those two committed digests and those two instants against the declared window tolerance. It does not disclose any position, balance, holder identity, or account identifier. It does not attest that either committed digest is a correct digest of the record it names, because confirming that requires read access which this receipt does not confer. It does not decide which record is correct when the two records diverge, assigns no fault to either operator, does not decide whether the underlying settlement, transfer, or register update was proper, and does not effect or reverse any settlement. A window_exceeded outcome records only that the two observations were too far apart for the comparison to be decisive.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
“There’s no framework yet for ‘I asked my agent to buy something inexpensive, and it bought something expensive instead,’” per your article. The word doing the damage in that sentence is inexpensive. It is not checkable. This receipt classifies whether an instruction was checkable at the moment it was fixed, against a ruleset committed before it, so the answer is not decided later by whoever is about to pay.
The operator declares the kinds of predicate its committed instruction contained. Not the text. Kinds, carried as keyed pseudonyms. The service classifies each kind against a published ruleset and recomputes a verifiability_class of machine_checkable, partially_checkable, subjective or unclassifiable. The class is never accepted from the caller, VERIFIABILITY_CLASS_RECOMPUTE derives it, and mint refuses to sign a body that arrives with the class already filled in.
RULESET_PRECEDENCE is the gate that makes this worth anything to a merchant. The digest of the classification ruleset has to have been committed at or before the instant the instruction was fixed. If the ruleset came later, the receipt gets a precedence_class of ruleset_follows_intent and fails closed. That cuts both ways on purpose. It stops a platform claiming a loose instruction was checkable, and it stops anyone tightening the ruleset once a chargeback is on the table.
Run the unclassified case below. It comes back with valid true and a class of unclassifiable, because the precommitted ruleset never named one of the declared predicate kinds. It is not a hedge. It is the receipt declining to guess about a predicate nobody had classified in advance, and it is the state a careful reader on the other side of a dispute will look for first. The service never receives the instruction text. NO_INTENT_CONTENT_LEAK is a gate and the schema will not accept a body carrying words a shopper said.
What it does not prove, in plain words. It does not say the instruction was reasonable or that the shopper understood it. It does not say the declared predicate kinds are complete or honestly declared, and it does not say these are the predicates a court or a regulator would think mattered. It decides no dispute, either way, and it entitles nobody to rely on the class. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed a verifiability class from the declared predicate kinds of one committed intent, against a classification ruleset whose digest was committed at or before the intent was fixed. It does not attest that the intent was reasonable, that the Card Member understood it, that the declared predicate kinds are complete or honestly declared, that the predicates are the ones a court or regulator would consider material, that any claim is payable or deniable, or that any party is entitled to rely on the class. This service does not read the intent text and never receives it.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Your FAQ describes know your agent as verifying “that an agent meets the conditions required before it’s allowed to take an action,” and names Web Bot Auth and your own Ravelin detection as the tools available at the merchant edge, per the same article. Detection answers which agent is calling. A month later the question is narrower: whether the agent that transacted is the agent that was admitted.
The receipt takes two things. One admission credential, and one receipt of something the agent did. It checks that both name the same subject by deriving a commitment from each under a single salt the credential itself already committed to. The gate is SUBJECT_COMMITMENTS_IDENTICAL and it wants the two commitments byte identical. Then TEMPORAL_RELATION checks that the conduct happened at or after the admission and inside a maximum separation signed in advance, so a credential cannot be stretched over conduct it was never meant to cover.
Neither identifier appears in the signed body. The subject is carried as a commitment, so the receipt travels to a scheme, a merchant or a platform without naming the agent, the operator or the shopper. What it gives you is a claim that survives being challenged: both sides can recompute the same answer from the same two artifacts, and neither has to open its detection stack to the other.
What it does not prove, in plain words. It does not say the credential was validly issued or that the admitting party was entitled to admit. That is the scheme’s own act and this receipt does not reach into it. It does not say the conduct happened or that the conduct was allowed. It ties two artifacts to one subject and puts them in order. The boundary, verbatim from the schema. This receipt attests only that a supplied admission credential and one supplied conduct receipt yield byte identical subject commitments under one disclosed binding salt that the admission credential already commits to, and that the extracted conduct instant is at or after the stated admission instant and within the signed maximum separation. It does not attest that the admission credential is validly issued, that any admitting party is entitled to admit, that either identifier is true, that the subject is a person or entity of any asserted kind, that the conduct occurred, or that the conduct is authorized. It does not decide authenticity beyond the checked signatures and stated verification class, completeness of records, actual knowledge, intent, fault, fraud, contractual effect, legal effect, regulatory effect, eligibility, title, responsibility, liability, or any dispute. It does not authorize admission, access, conduct, a transaction, credential presentation, disclosure, or reliance by any party. It does not establish that either source artifact is complete, exclusive, current, unrevoked, unaltered before receipt, or truthful. It cannot decide whether an absent conduct receipt exists, whether another admission credential exists, whether the admitting party relied on the credential, whether the conduct service observed all conduct, or whether any party knew of the other artifact.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Your article names Verifiable Intent and AP2 as the protocols pointing toward what an intent record could look like, and says Worldpay is “working with the platforms building them to collect that data and pass it through the payment flow to merchants.” Passing it through is transport. This is the check that runs on it: one transaction against the constraints of the delegated authority that was signed before it. The second run below hands in a receipt that calls a breach a pass, and the verifier returns valid false.
The amount, the currency, the timing and the scope of one transaction are compared against the constraints of one delegated authority receipt, and MANDATE_PRECEDES_TRANSACTION requires that authority to have been signed before the transaction was authorised. CONFORMANCE_RECOMPUTE and OUTCOME_RECOMPUTE then derive the per constraint results and the overall outcome rather than accepting them, which is exactly what the fail run demonstrates: hand in a body whose declared result is pass where the recomputed result is fail, and the receipt does not verify.
NO_PAN is a gate. No cardholder credential goes in and none can. That matters for where this can sit in your stack: the check runs on commitments and constraint terms, so it can run beside the payment flow rather than inside it, and it never becomes a place where card data lives.
What it does not prove, in plain words. It does not attest that the shopper granted the delegation, that the declared agent identity is genuine, or that the transaction was authorised or settled by any network. It is not a payment authorisation and carries no cardholder credential. It does not deny, resolve or adjudicate any dispute, and it does not limit any right a consumer holds under Regulation E, Regulation Z, or any equivalent rule. It evaluates one transaction against a per transaction constraint and evaluates no cumulative spend, velocity or aggregate limit. The boundary, verbatim from the schema. This receipt attests that the named transaction's amount, currency, timing and scope were compared against the constraints of one specific delegated authority receipt that was signed before the transaction was authorised, and that the outcome was recomputed by this service from that comparison rather than supplied by the caller. It does not attest that the cardholder granted the delegation, that the declared agent identity is genuine, that the transaction was authorised or settled by any network, that goods or services were delivered, or that the displayed terms digest corresponds to anything a person actually read. It is not a payment authorisation and carries no cardholder credential. No card network, issuer, or regulator currently recognises this receipt as authentication data, as compelling evidence, or as a liability shift, and it does not create one. It does not deny, resolve, adjudicate or affect any dispute, and it does not limit any right a consumer holds under Regulation E, Regulation Z, or any equivalent rule. This receipt evaluates one transaction against a per transaction constraint and does not evaluate cumulative spend, transaction velocity, or any aggregate limit across multiple transactions under the same mandate, so a series of individually conforming transactions may still exceed a spending intent this receipt cannot see. It evaluates the delegated authority receipt as supplied and inherits that receipt's revocation limitation, so it does not attest that the mandate was still unrevoked at the moment the transaction was authorised.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Every run on this page posts a request body from this domain to https://thehiveryiq.com/v1 plus the route shown above each block, and prints what came back. The example receipts are signed with published example keys, so verify reports key_trust example_registry. That is deliberate. Nothing here is a production issuance, a customer record, or an endorsement. Patent Pending.
An acquirer’s dispute and settlement volume today is almost entirely non agent. Any instrument that only pays off when agent volume gets material is a bet, and you would be right to price it as one. These four are not that. fault.attribution, recovery.determination, intent.affirmation and ledger.parity all operate with no agent party present at all, and the reason sits in the schemas rather than in the pitch.
| Receipt | What it does on ordinary non agent traffic | What the schema actually requires |
|---|---|---|
| fault.attribution | An ordinary chargeback. A loss is placed against whichever party broke a rule it had committed to before the loss, where the parties are the cardholder, the merchant and the issuer, with no agent among them. | Four roles are allowed, principal, agent_operator, acceptor and issuer, each at most once and none of them required. party_count has a minimum of 2 and a maximum of 4. attributed_role is nullable. A minted and verified receipt over principal, acceptor and issuer returns valid true and attributes to acceptor. |
| recovery.determination | Ordinary loss allocation between two parties who committed a table in advance. Who carries it becomes a lookup instead of a queue of arguments. | Its outcome keys include single_party:principal, single_party:acceptor and single_party:issuer. The fault attribution it reads can name any of the four roles, and agent_operator is one option rather than a requirement. A determination built on the no agent attribution above verifies with outcome key single_party:acceptor. |
| intent.affirmation | Any checkout where the amount the customer saw has to be the amount that was transmitted. Card not present representment, subscription upgrades, quantity and shipping changes at the last screen. | The word agent does not appear in this schema. Neither does mandate. The signed body carries a subject pseudonym, two opaque artifacts and three instants. The channel enum already covers interactive_display and embedded_webview, which is an ordinary web checkout. |
| ledger.parity | Ordinary settlement and funding reconciliation. Your file and a counterparty’s file are compared at a named cursor and a named instant, and neither side opens its books. | The word mandate does not appear. The only string containing the word agent is the record kind transfer_agent_register, which is a securities register rather than an AI agent. Record kinds are book entry registers, custodial subledgers, internal ledgers and distributed ledgers. |
How that claim was checked, so you can check it too. The four schemas were read for any required agent or mandate field, and there is none. Then receipts were minted and verified with no agent role present at all: a three party fault attribution over principal, acceptor and issuer returns valid true with attribution_class single_party and attributed_role acceptor, a two party version over principal and acceptor does the same, and a recovery determination built on the three party attribution returns valid true with attribution_outcome_key single_party:acceptor. A single party attribution is rejected at mint, because two parties are the minimum for an allocation to mean anything.
One precise caveat, because it would be easy to overstate this. The published example bodies behind the fault.attribution and recovery.determination runs on this page do include an agent_operator party, since these are agentic commerce demonstrations. The no agent result above comes from minting and verifying fresh receipts against the same deployed schemas rather than from those two demo bodies. The intent.affirmation and ledger.parity bodies on this page contain no agent field of any kind, so those you can confirm from the demo output itself.
And there is a reason to expect the ordinary case and the agent case to behave alike. Your colleague’s own read, from the follow up piece nine days later: “Suresh said Worldpay is not currently seeing evidence that agentic transactions carry different friendly-fraud characteristics than existing channels, and will update merchants as scheme guidance develops,” per Worldpay Insights, August 6, 2026. If the friendly fraud shape is the same, the evidence shape that answers it is the same. So this earns its place on traffic you already process, and it is already installed on the day agent volume matters.
Seven receipt types is a lot to read. The install is not, and the way it installs is the reason this is cheap to try and cheap to stop. For a processor that is the only part of an evaluation that actually matters.
Hive sits next to your gateway and your dispute tooling, not inside them. Minting and verifying are ordinary HTTP calls to a service outside your loop, the verifier makes no outbound call of its own, and nothing in it sits between a transaction and an authorization message. The evidence is emitted beside the event, so the payment never waits on the receipt.
If Hive is slow, if Hive is down, or if you rip Hive out, authorization and settlement complete exactly as they do today. Nothing declines because of Hive. A receipt that never got written stays visibly missing rather than getting backfilled later. Receipts you already hold keep verifying offline against the published key, with no call to us.
Every verify route on this page is open and unauthenticated. No token to request, no signup, no invoice. The envelope form, the canonical bytes and the schemas are published, so a merchant, a platform or a regulator holding one receipt can check it on a laptop with an Ed25519 library and no network.
Two kinds of failing, pointed in opposite directions on purpose. The deployment fails open, because Hive is not standing in the way of a transaction. The instrument fails closed: when a constraint was written after the loss, when a declared result does not match the recomputed one, or when two clocks overlap too much to order, the receipt returns indeterminate or refuses to verify. Scroll up and watch it. The hindsight run names nobody, and the two fail runs come back valid false with the gate that stopped them printed on screen.
Taking it out leaves nothing to unwind. No shim in the authorization path, no policy to restore, no settlement dependency to migrate, because Hive never held any of them. What you keep is every receipt you already collected, and those verify without us. That is the honest version of a low switching cost. It cuts against us and it is still the right way to build this.
Signing details, since your team will ask. Ed25519 plus ML-DSA-65 under FIPS 204, with a 1952 byte public key and a 3309 byte signature, over RFC 8785 JCS canonical bytes. Verification runs in single digit milliseconds. All methods Patent Pending.
What this section does not claim. It describes where the software sits and how it behaves when it is absent. It says nothing about anything Worldpay or Global Payments has built, bought or deployed, and it is not a claim that any of this is running anywhere near you.
Your article’s closing position is that this gets solved by merchants and their PSPs building the evidence layer underneath the protocols rather than by picking a winner. Nothing here replaces any of that work, and none of it competes with a receipt.
Reshmi Suresh is quoted in the launch: “Having an open standard that allows them to verify intent, while also giving them the choice to preserve their privacy, is key to increasing adoption,” per Mastercard, March 5, 2026. A tamper resistant record says what was authorised. It names no party to rule on what then happened.
Worldpay continues its work with Google on the Universal Commerce Protocol, per Worldpay, January 28, 2026, and your article names AP2 as pointing toward what an intent record could look like, per the AP2 specification. Signed mandates say what was permitted. They appoint no arbiter.
Your FAQ names both as the merchant edge answer to agent verification, per the article, alongside Cloudflare’s Web Bot Auth. They answer which agent is calling. They do not answer what that agent did with the authority it held.
Your article records that EMVCo has stood up a dedicated task force on agentic payments, per the article. Specification work sets the shape of the message. The evidence object that survives a dispute is a separate question, and your own article says the contract does not exist.
The Linux Foundation declared the x402 Foundation operational on July 14, 2026. x402 standardises how a machine pays. It does not decide whose conduct caused a loss when the payment was wrong.
An independent verification layer the protocols above deliberately leave open, because a protocol cannot appoint its own referee. A small object with a fixed non party signer role and a published boundary. Free to verify, offline, against a published key, with no account.
And the timing is yours rather than ours. Cameron Bready on the Q2 call: “We now have multiple Agentic commerce pilots in flight with leading AI platforms and some of the world’s largest global retailers,” per the Global Payments Q2 2026 earnings call, August 5, 2026. Pilots are where an evidence layer is cheap to add and expensive to retrofit.
Run it in shadow against real dispute traffic. Your own keys, your own sandbox, nothing in the money path, whatever slice of your chargeback queue you are comfortable with. Mint the receipts beside the cases you are already working. Nothing about it can decline a transaction, delay a settlement, or change a representment outcome, because it is not standing anywhere near any of those.
Then hold the receipts against your own case files. Take a week of closed disputes where you know how they went, and check whether the attribution the verifier recomputes matches the answer your analysts reached, and whether the cases it returns indeterminate are the cases that were genuinely a coin flip. If the receipts disagree with your analysts more than they agree, you lost a sprint and you keep every receipt.
If they agree, Worldpay is the first acquirer that can hand a merchant, an agent platform or a scheme a determination that nobody has to take your word for. And by your own sentence, the alternative stays a default: “No liability shift exists yet.”
Nothing in the money path. Nothing to unwind if you stop. Every receipt you collect stays yours and stays checkable either way.
Eight entries, in the order they appear above. Each link opens that entry in the canon implementation explorer, where its schema, verify route, auth requirement, benchmark and implementation state are stated in full. The state shown here is read from the same registry file the explorer renders from, so the two cannot drift apart. Nothing here implies a customer, a deployment or an endorsement.