Can a merchant lower these thresholds so the agent acts faster?

No. A mandate rule can require more approval than the default floor, never less. The floor is a minimum, not a default that can be relaxed.

Is this the same as buyer approval before paying?

No. This control is over the operator agent managing YOUR store (catalog, refunds, pricing). Buyer approval before a shopping agent checks out is a separate, opt-in mechanism, described in the checkout documentation.

Agent control

We make sure a person has authorized every decision that matters

It is not a lock on everything the agent does — that would make catalog browsing pointless. It is a floor that cannot be lowered on what can cause harm: moving money, changing prices, or touching a customer's data.

Enforced in production today — not a roadmap item

What requires human approval, and how much

Every capability we grant an operator agent carries a minimum threshold assigned by its risk class — not a generic list, one per capability.

Refunds and returns

Always requires your approval

Money leaves your account. No agent issues a refund unassisted.

Exporting or deleting customer data

Always requires your approval

GDPR-class actions. A single human approval is mandatory before data leaves or is erased.

Bulk repricing across your catalog

Cooldown — a reflection window before it executes

A single approval on a catalogue-wide change is worth a pause, not a blanket block.

Payment method configuration

Cooldown — reflection window

PCI-adjacent: configuration changes get a pause before taking effect.

Policy changes, staff permissions, admin actions

Dual control — two people, not one

Governance-level changes require a second approver by design.

The floor cannot be lowered

You can configure your store to require more approval than the default threshold. You cannot configure it to require less. A stricter rule overrides the floor; a looser one never applies.

You can revoke on the spot

If something goes wrong, revoking an operator agent's credentials is immediate: we sign a revocation list (the same pattern as a CRL/OCSP) that any verifier can check against our public key.

This is not the same as buyer consent

Operator-agent control (this page)

About the agent managing YOUR store: catalog, refunds, pricing, staff. You, the merchant, set the floor — and it cannot be lowered.

Buyer consent to a shopping agent

About whether a buyer authorized a specific purchase a shopping agent executes on their behalf. It is a separate, opt-in mechanism, and not covered on this page.

Are you a developer or auditor?

Exact per-capability thresholds, the mandate format, and how it relates to FIDO Alliance's AATWG delegated-authority framework.

See the technical detail