Verifiable intent means a user's instruction to an AI agent is captured as a signed, tamper-evident record, often called a mandate, that travels with the agent and can be checked by anyone the agent transacts with. Instead of trusting that an agent is acting on a real customer's wishes, a merchant or payment provider verifies the cryptographic link between the human's authorization and the specific action the agent is taking. Trust shifts from "believe the agent" to "check the instruction."
The problem verifiable intent solves is simple to state. When an AI agent buys something on your behalf, the merchant never sees you. It sees software making a request. Without proof of intent, the merchant cannot tell an authorized purchase from a compromised agent, a hallucinated order, or outright fraud. And when the cardholder later says "I never asked for this," nobody can prove otherwise.
A verifiable intent record fixes that by binding three things together: who authorized the action, what they authorized, and the limits on that authority. In practice the record is signed with a key the user controls and carries explicit scope, such as a product category, a price ceiling, and an expiry time. The agent presents the mandate when it acts. The verifier checks the signature, confirms the action falls inside the scope, and confirms the mandate has not expired or been revoked. An agent that drifts outside its instructions fails the check.
This matters most at the moments where money and liability move. A merchant that can verify intent has a defensible answer when a transaction is disputed. A payment provider can distinguish "the agent exceeded its mandate" from "the customer changed their mind," which are different problems with different owners. That evidence trail is what makes delegation to agents insurable and disputable rather than a leap of faith.
As of September 2026, verifiable intent is a design pattern appearing across agentic payment protocols rather than a single settled standard. The concepts are converging: signed mandates, scoped delegation, revocation, and audit logs that bind each transaction back to a human instruction. What is not yet settled is who issues and verifies these credentials at scale, and whose format wins. The infrastructure is ahead of the demand, and the trust question is exactly where the competition sits.
The gap I keep coming back to: a mandate proves what was authorized, not whether the agent interpreted the instruction well. Verifiable intent bounds the damage. It does not remove the judgment problem.
Go deeper: Who authorized the agent? and the trust gap in agentic commerce.