Mastercard's Verifiable Intent: Solving the Trust Problem in Agentic Commerce

When a human taps a credit card, intent is obvious. But when an AI agent books a flight using instructions you gave it three days ago — who authorized that? Was it exactly what you asked for? And if the charge is wrong, how do you prove it?

These aren't hypothetical questions anymore. With AI agents increasingly handling real financial transactions, the industry needs real answers. On March 5, 2026, Mastercard published one.

What Is Verifiable Intent?

Mastercard introduced Verifiable Intent — an open-source, standards-based framework designed specifically for agentic commerce. The concept is straightforward: link a consumer's identity, their specific instructions, and the resulting transaction into a single, tamper-resistant cryptographic record.

Every agentic purchase generates what is essentially a verifiable audit trail. That trail travels with the transaction, and any party in the chain — merchant, bank, consumer, or agent — can consult it to verify what actually happened.

"As autonomy increases, trust cannot be implied," said Pablo Fourez, Chief Digital Officer at Mastercard. "It must be proven. And if something goes wrong, everyone needs facts, not guesswork."

The Mechanics: Selective Disclosure

One of the more technically interesting aspects of Verifiable Intent is how it handles privacy. The framework uses a technique called Selective Disclosure, which shares only the minimum information needed with each party.

A merchant confirming that an agent is authorized to purchase doesn't need access to your full transaction history. A bank resolving a dispute doesn't need to know every instruction you gave your agent. Selective Disclosure provides just enough to verify — and nothing more.

This approach keeps the framework lightweight and privacy-respecting while still enabling clear accountability at every step.

Building on Agent Pay

Verifiable Intent doesn't stand alone. It's an addition to Mastercard Agent Pay, the company's broader agentic payments program launched back in 2024, which established the infrastructure for registering and authenticating AI agents before they can transact on Mastercard's network.

Think of Agent Pay as the foundation (who is this agent, is it allowed to act?) and Verifiable Intent as the proof layer on top (what did the agent do, did the consumer authorize it, and can we prove it?). Together, they create a more complete trust model for agent-led transactions.

Mastercard says Verifiable Intent will be integrated into Agent Pay APIs within months of the March 2026 announcement.

Protocol Agnostic, by Design

A key architectural decision: Verifiable Intent is designed to be agnostic to existing agentic protocols. It doesn't try to replace MCP, A2A, or whatever comes next. Instead, it's intended to layer on top of whatever infrastructure is already in place.

Mastercard developed the standard alongside Google and says it's designed to work with the broader ecosystem of agent frameworks being built across the industry. The open-source approach means anyone can implement it, audit it, and extend it.

Why This Matters Now

The timing is deliberate. PYMNTS Intelligence research found that one of the highest-ranked enterprise use cases for agentic AI is dynamic budget reallocation based on real-time cost data — with roughly 43% of CFOs expecting high impact from agentic handling of this function, and another 47% expecting moderate impact.

Enterprises won't hand agents that kind of financial authority without audit trails. Consumers won't trust agents shopping on their behalf without clear authorization records. And merchants won't accept agent-driven purchases without dispute resolution tools that actually work.

Verifiable Intent is an attempt to give all three parties what they need from a single standard.

The Bigger Picture

What Mastercard is proposing isn't just a payments feature — it's a template for how trust should work in an agentic world. The core insight is simple: when AI acts on your behalf, the proof of authorization needs to be baked into the action itself, not reconstructed from logs after the fact.

Whether Verifiable Intent becomes the dominant standard or just one among many remains to be seen. But the problem it's solving — how do you verify intent when the actor isn't human? — is one every agentic system will eventually need to answer.

Sources: