axiorank/agent-commerce-conformance

Agent Commerce Conformance is an open standard and reference implementation for proving that an AI agent's purchase stayed within limits a user agreed to in advance. When an AI agent shops on someone's behalf, this project defines how to create and verify proof that the agent only bought things within the budget, merchants, and categories the user pre-approved. The core piece is a receipt: a cryptographically signed record that proves three things. First, that an action is recorded in an append-only audit log. Second, that the record was not altered after it was written. Third, that the action was authorized by the correct chain of people and systems, for example: user approved the budget, then the AI agent executed within it. The verification uses Ed25519 digital signatures and a Merkle tree structure, both standard cryptographic techniques. All the verification code is about 200 lines with no external dependencies. The commerce-specific piece is called a Commerce Conformance Seal. When an AI agent makes a purchase, it attaches a signed seal stating that the purchase was within the user's mandate. A mandate is a document signed by the user or their bank that defines the spend cap, allowed merchants, allowed currency, and the time window. A merchant, a bank, or the buyer can all verify the seal offline without calling any server. The project is available as an npm package called @axiorank/audit-verify. It requires Node 18 or later. Both a JavaScript/TypeScript API and a command-line verifier are included. For genuine independent verification, the README instructs users to pin the issuer's public key from a separate source rather than fetching it from the same party that issued the receipt. The license is MIT.