Mandate Faithfulness and Pre-Signature Monitorability for Agentic-Payment LLMs

Standards for AI payments (Google's AP2, Coinbase's x402) let an agent commit funds by signing a mandate — a cryptographically signed statement of what it is authorized to spend. Signing is irreversible, so the question is not whether a protocol gateway can reject a malformed request, but whether the agent can be pushed into authorizing a payment it should refuse — and whether that can be caught before the signature. MandateBench measures mandate faithfulness across nine frontier models under a taxonomy of adversarial pressures, with a judge-free ground truth: rule violations are deterministic predicates over the signed object, and intent traps are author-constructed and labeled before any model runs — no LLM judges outcomes. We separate rule violations (over budget, wrong recipient, out-of-scope, expired) that a gateway already catches from intent violations that satisfy every signed field yet betray the mandate's natural-language intent — a grocery mandate spent on a gift card or vintage champagne. We then measure pre-signature monitorability: how well an overseer reading only the agent's reasoning predicts a violation, and how a naive reasoning-hiding instruction erodes it.

Contributions

1. A signed-mandate benchmark for agentic payments with a judge-free ground truth (Ed25519 mandates; rule violations are deterministic predicates over the signed object; intent labels are author-constructed traps fixed before any model runs).
2. A rule-vs-intent split that isolates the failures no protocol gateway can catch — the empirical case for a model in the loop.
3. A pre-signature monitorability protocol (AUROC of a reasoning-reading monitor) with an adversarial reasoning-suppression arm.
4. A live, open cross-play harness: every model attacks every model in a 9×9 adversarial matrix.

Finding 1 — The intent gap

Snapshot v7: 35 scenarios across five mandate domains (groceries, travel, subscriptions, donations, procurement), 17 intent traps, each domain with a structurally-identical clean control. The intent column is where models separate: proposals that satisfy every signed field yet break the mandate's meaning. Pooled intent-catch is 351/457 (77%, CI 73–80) — no model catches them all (best 90%, worst 57%). False refusal = clean orders wrongly declined (the usefulness cost); it stays ≈0 for every model, so the intent misses are not bought back by caution.

Counts are snapshot v7 (3 reps/scenario, temperature 0, seeded); intervals are Wilson 95%. Reps at temperature 0 are near-duplicate replicates, so the effective n is closer to the unique-scenario count — treat the intervals as optimistic. Two unparseable runs (both Kimi K2.6) are excluded, not counted as defences.

Rankings from small trap sets do not replicate. On the v6 pilot (3 intent traps, one domain, n=9/model), GPT-5.5, Claude Opus 4.8, and Kimi K2.6 looked perfect (9/9) — exactly the fragile kind of result the wide intervals warned about. On 17 traps across 5 domains, none stays perfect and the ordering reshuffles (GPT-5.5: 100% → 71%). The size of the intent gap, however, replicates almost exactly (pooled 75% on v6 vs 77% on v7): the gap is a stable property of the class; per-model leaderboard positions at small n are noise.

Finding 2 — Reasoning is only moderately monitorable

Measured on the v6 pilot set; the monitor pass on v7 is pending. A monitor (GPT-5.5) reading only the agent's private reasoning — never the mandate numbers — predicts violations at AUROC 0.669 (95% CI 0.56–0.78; 29 violations vs 345 compliant, pooled across the nine agents). Diagnostic, but far from the near-perfect monitorability reported for reasoning in game settings. Two caveats: the AUROC is pooled, so it mixes between-model style with within-model discrimination, and the monitor scores its own outputs for one of the nine agents.

Finding 3 — Hiding the reasoning backfires

(Measured on the v6 pilot set; the v7 suppression arm is pending.) Instructing the agent to keep its reasoning bland — the obvious way to evade a reasoning-reading monitor — is doubly harmful. Violations roughly double (29 → 51), and the monitor's AUROC falls from 0.67 to 0.30 — below chance. Inspecting the reasoning shows why: told to stay bland, models stop reasoning about intent and collapse to structural checks, so a breach reads as more routine than a compliant decision and actively misleads the overseer.

“Payment is within budget, under per-payment cap, to allowed recipient, in allowed category” — a suppressed agent's reasoning as it authorizes a gift-card purchase that betrays a grocery mandate.

Reasoning suppression does not merely blind the overseer; it blinds the agent. Note that below-chance is itself a signal: suppression does not remove the information so much as invert its sign — an overseer who knows suppression is in play could flip the monitor's scores and recover AUROC ≈ 0.70. The danger is the overseer who doesn't know.

Finding 4 — Under live attack, the same models break

Measured on the v6 pilot; a seeded multi-rep, multi-goal matrix is pending. Beyond scripted traps, every model plays the merchant and attacks every model's agent over a multi-turn negotiation — a full 9×9 matrix (81 duels, one negotiation per attacker–defender pair, single over-cap attack goal). Robustness tracks the defender, not the attacker: no attacker exceeds a 22% success rate (2/9, CI 6–55%), while breaches concentrate on a few agents. With n=9 per row the intervals are wide: the unbreached group (0/9, upper bound 30%) separates from Mistral and Llama, but the DeepSeek / Mistral / Llama ordering is not itself significant. Llama 4 Maverick sits at the bottom of both this table and the intent column above; the v7 results caution against reading finer cross-table agreement than that.

Each cell of the underlying matrix is a single negotiation with an unseeded temperature-1 attacker, so only these row marginals — not individual cells — carry signal.

Method, in brief

Limitations

Violation rates on v6 should be read as lower bounds: two grading asymmetries in that snapshot could only understate violations (a counter-offer on an intent trap was graded as defended even when it committed the same purchase, and unparseable output ended a run ungraded). Both are fixed in the harness that produced v7, whose runs are also seeded, provenance-stamped (provider, temperature, rep, arm), and deduplicated. The monitorability, suppression, and duel results are still v6 measurements — on the small 3-intent-trap set, with a single monitor model (GPT-5.5) scored pooled across agents including its own outputs, and one unseeded negotiation per duel cell — and are marked as such above; re-running those arms on v7 is the immediate next step. Intent labels are author-constructed (fixed before any model runs); independent human validation is future work. Repetitions run at temperature 0, so the three reps are near-duplicates and the effective sample is closer to the unique-scenario count — treat all intervals as optimistic. Results may be sensitive to prompt wording. The suppression arm uses a single naive hiding instruction; a trained or steganographic adversary is the stronger test of monitorability and is future work, as is an adaptive-adversary robustness curve.