Comparisons · as of June 2026
Feature matrix: the agent authorization landscape
Sixteen dimensions, five provider classes. In four rows, according to our research (as of June 2026), none of the other provider classes has an offering: non-payment actions, the two-sided network, templates with legal wording and verifier-owned acceptance policies. Legend: ✓ available · (✓) partial or announced · – not available or not a goal.
| Feature | Mandact | AP2 (FIDO) | Visa TAP / MC Agent Pay | Stripe (ACP/SPT/MPP) | Okta (AI Agents/XAA) |
|---|---|---|---|---|---|
| Layer | Mandate / law | Payment mandates | Card network | Processor / dev tools | Enterprise IAM |
| Non-payment actions (cancellation, appointment, data release, HR, authorities) | ✓ 123 action types, 17 domains | – | – | – | (✓) internal only, app-related |
| Payment mandates | (✓) payment.* encapsulates AP2 | ✓ intent / cart / payment | ✓ agentic tokens / verified agent ID | ✓ SPT, scoped virtual cards | – |
| Two-sided network (principal and verifier as customers) | ✓ | – protocol, no operator | – merchant side | – merchant side | – employer side |
| State identity root (E-ID/EUDI, SD-JWT/OID4VC) | ✓ schema-native, same stack as swiyu | (✓) W3C VCs, no state root | – card credential | – account credential | (✓) VDC only FY27 |
| Templates with legal wording (CO 32 ff. / BGB 164 ff.) | ✓ | – | – | – | – |
| Evidence chain (append-only, hash-chained, database-enforced, export) | ✓ + path to qualified timestamps | (✓) signed mandates, no vault | (✓) network logs | (✓) Stripe logs | (✓) audit logs |
| Kill switch / revocation with mandatory real-time status | ✓ MD-201 tested | – open in the spec | (✓) token block | (✓) card cancel | (✓) session logout |
| Escalation / step-up (human above a threshold) | ✓ E2E: 600 s, single-use tokens | (✓) v0.2 moves towards human not present | – | – | (✓) async approvals (Auth0) |
| Four eyes / organisational signing rules | ✓ enforced by database trigger | – | – | – | (✓) governance workflows |
| Constraints: amount + frequency + geography + time window | ✓ all four, 19 stable MD codes | (✓) amount / intent | (✓) amount / scope | ✓ amount / merchant / time | (✓) scopes / policies |
| Verifier-owned acceptance policies (LoA, maxAmount, attestation) | ✓ rule editor | – | – | – | – (reverse role) |
| MCP integration (agent uses mandates as a tool) | ✓ 5 tools, tested over stdio | (✓) MCP extension | – | ✓ agent toolkit | (✓) XAA protocol |
| Open governance | ✓ OMP as a profile on top of the standards | ✓ FIDO Alliance | – proprietary | – proprietary | (✓) XAA open |
| EU data residency / eIDAS evidentiary value / AI Act Art. 14 mapping | ✓ core positioning | – US-centred | – | – | – |
| Enterprise-internal agent discovery | – (AgentryGov bundle) | – | – | – | ✓ core product |
Status & positioning in one sentence
AP2 (FIDO Alliance)
Donated to the FIDO Alliance (April 2026), v0.2 with human-not-present payments; PSPs issue AP2 mandates that Mastercard accepts as Verifiable Intent.
The neutral mandate format for payments — Mandact encapsulates it as a payment.* subtype instead of competing.
Visa TAP / Mastercard Agent Pay
US Mastercard cardholders broadly enabled since November 2025, global rollout under way; Europe's first live agent payment in early 2026.
Card credential for agents — owns the payment, never the action.
Stripe (ACP / SPT / MPP)
MPP shipped as GA, Shared Payment Tokens rolling out with Visa, Mastercard, Klarna and Affirm.
Developer rail for agent checkouts — an integration target, not a competitor.
Okta for AI Agents / XAA
GA since 30 April 2026; Microsoft Entra and Google Workspace developing competing products; verifiable digital credentials announced for FY27.
Answers which internal agents a company has — the closest functional neighbour, complementary to the external mandate.
Mandact (OMP)
OMP v0.5.2: 19 rejection codes, API keys, rate limits, evidence export — verified by machine throughout.
Was this third-party agent allowed to do that towards me — and who can prove it?