--- name: ap2-risk-signals description: > Implement the AP2 risk signals framework — novel risk considerations for agentic payments, risk payload construction, trust establishment, and fraud assessment. Use when building risk evaluation, fraud detection, or trust scoring for AP2 transactions. --- # AP2 Risk Signals Framework ## Before writing code **Fetch live docs**: 1. Fetch `https://ap2-protocol.org/ap2/specification/` for risk payload specification 2. Fetch `https://ap2-protocol.org/ap2/security_and_privacy_considerations/` for risk considerations 3. Web-search `ap2 protocol risk signals fraud agentic payments` for risk framework details 4. Web-search `site:github.com google-agentic-commerce AP2 risk` for implementation references ## Conceptual Architecture ### Why Risk Signals Matter Agentic commerce introduces **novel risk dimensions** that traditional payment systems weren't designed for. AP2's risk signals framework provides a common language for all ecosystem participants to assess transaction risk. ### Novel Agentic Risk Factors (from the official AP2 risk factor table) | Risk Factor | Description | |------------|-------------| | **User asynchronicity** | User may not be present during the entire transaction journey | | **Delegated trust** | Agents initiate transactions on behalf of users | | **Mandate-merchant matching** | Verifying the purchase matches the authorized intent | | **Temporal gaps** | Time between token generation and payment execution | | **Indirect trust establishment** | CP and Merchant may not have a direct trust relationship | | **Agent identity verification** | Verifying the agent is who it claims to be | ### Additional AI-Specific Risks (not from the official AP2 risk factor table) The following are additional AI-specific risk considerations relevant to agentic commerce implementations, but they are **not part of the official AP2 specification's novel risk factor table**: | Risk Factor | Description | |------------|-------------| | **Agent hallucination** | AI agent may misinterpret user intent | | **Prompt injection** | Malicious inputs that manipulate agent behavior | ### Risk Payload The risk payload is an **open-ended field structure** — deliberately unconstrained so the ecosystem can converge on conventions. Check the release you target for any fields that have since been formalised: - Intentionally flexible for industry-specific risk signals - Allows Credentials Providers, Merchants, and Networks to pass custom risk data - Each actor contributes their own risk assessment signals - The payload travels with the mandate through the transaction flow ### Risk Assessment by Role #### Shopping Agent - Quality of intent capture (how clearly the user expressed their intent) - Session authentication strength - User behavioral signals #### Credentials Provider - Payment method risk level - User account history - Device trust score - Previous transaction patterns #### Merchant - Order anomaly detection - Intent-to-cart matching confidence - Fulfillment risk assessment #### Network/Issuer - Card risk signals (fraud patterns, velocity checks) - 3DS challenge decisions - Authorization risk scoring - AI involvement context (from Payment Mandate) ### Trust Establishment AP2 defines trust establishment phases: **Short-term (early releases)**: - Manually curated allowlists per entity - Known partner relationships - Pre-configured trust **Long-term (direction of travel)**: - Real-time trust via HTTPS certificate validation - DNS ownership verification - mTLS (mutual TLS) for strong identity - API key exchange - Identity assertions in A2A/MCP protocols - Agent reputation systems ### Dispute Risk Assessment For dispute resolution, risk signals help determine accountability: - Strong user authentication → lower risk of ATO (account takeover) - Clear Intent Mandate → lower risk of agent mispick - Valid merchant signature → merchant committed to terms - Matching mandate vs delivery → no fulfillment fraud ### Best Practices - Include as many risk signals as available — more data helps better assessment - Don't rely solely on LLM output for risk signals — use deterministic checks - Validate agent identity cryptographically, not just by self-declaration - Monitor for prompt injection in shopping intent - Track temporal gaps between intent capture and payment - Build risk scoring models specific to agentic transactions - Log all risk signals for post-transaction analysis - Implement anomaly detection for unusual agent behavior patterns - Update risk models as agentic commerce patterns emerge Fetch the specification for exact risk payload structure, supported signal types, and risk assessment requirements before implementing. --- Source attribution: OrcaQubits Original project: https://github.com/OrcaQubits/agentic-commerce-skills-plugins/blob/30cd25c74c8aa7dc49b3ec4847d463f6104439f6/dist/codex/ap2-agentic-payments/skills/ap2-risk-signals/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Dave AI. ## Upstream license notice MIT License Copyright (c) 2024-2026 OrcaQubits AI (https://orcaqubits-ai.com) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Dave AI resource metadata Creator / publisher: OrcaQubits Original project: https://github.com/OrcaQubits/agentic-commerce-skills-plugins/blob/30cd25c74c8aa7dc49b3ec4847d463f6104439f6/dist/codex/ap2-agentic-payments/skills/ap2-risk-signals/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Marketing, Sales Roles: Customer Success Manager, Data Analyst, Growth Marketer, Product Marketer, Sales Engineer Specialties: Specialty not specified Tools: Ap2 Protocol Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: fa388fc576d441681a3fc757a47dba43d6d9101758bfc41cc782133215339af9