Execution Authority for UCP

Published by Decionis under its own reverse-domain namespace, which UCP permits without maintainer approval. Not a UCP membership, endorsement, certification or partnership.

UCP settles how an agent transacts with a business — discovery, cart, checkout, order. It does not settle whether the agent was permitted to commit the transaction it is about to complete.

That gap is load-bearing rather than accidental, because UCP’s own checkout state machine already carries requires_escalation, described in the specification as covering “regulatory requirements, merchant policies, or capabilities the agent does not yet support”. A checkout in that state MUST carry a continue_url. The protocol reserved a place for an authority and left it for someone else to fill.

Three verdicts, three dispositions. The wire tokens are carried through unchanged; a checkout is not the place to invent a fourth vocabulary.

UCP ships dated releases and negotiates them by exact version, so what a merchant can actually read depends on which release they serve. Present in every published release (2026-01-23, 2026-04-08, 2026-08-25):

• status.requires_escalation
• continue_url

Available from the April release:

• signals

Available from the 2026-08-25 release:

• actions
• request_constraints
• independent capability versioning

This extension therefore escalates through the status enum, which every release has, and adds an outstanding Action only where the negotiated release carries one.

2026-04-08 with extension 2026-09-05: Existing April artifacts retain their original extension schema and status/continue_url behavior. They do not acquire Actions or Protocol 1.1 execution eligibility retroactively.

2026-08-25 with extension 2026-09-06: Existing 2026-09-06 artifacts retain their additive Protocol 1.1 fields and review Action contract. Protocol 1.1 authority commitments remain optional under that historical schema.

2026-08-25 with extension 2026-09-07: August negotiation adds the declared review Action. The 2026-09-07 schema requires the complete Protocol 1.1 authority, immutable policy, evaluation-semantics, input-snapshot, and execution-binding commitment tuple. Its checkout response envelope includes ucp.payment_handlers, official required line-item fields, and one unambiguous subtotal and total.

capabilities and payment_handlers are maps whose values are arrays of versioned entity references; payment handlers also require id.

A capability is active only through an exact supported extension version for the negotiated protocol release. The Decionis review Action additionally requires the active checkout base. A response reference may omit extends after profile intersection; if supplied it must include checkout. A key with an empty array is not negotiation.

AP2 mandates and this extension answer different questions, and the specification is what settles which is which. AP2 names exactly two signers:

• The business signs ap2.merchant_authorization.
• The platform or the user's wallet signs ap2.checkout_mandate.
• The PSP verifies payment_mandate and creates nothing.

AP2 names exactly two signers, and no third party may generate or sign a mandate claim. So AP2 proves the terms were not tampered with and that consent was captured — it cannot express whether the principal held the authority to commit those terms. That is a different question, and it travels alongside the mandates rather than inside them.

The escalation case is the one worth reading closely. The agent is not refused; the completion is held, and continue_url is where a human authority resolves it.

https://decionis.com/reference/ucp-execution-authority/examples/escalate.json

Approval is evidence, not a verdict: resolving an escalation re-runs the original request through the protocol with the approval in context, and the new outcome is what decides. A recorded approval never becomes an allow on its own.

Acceptance of a later Complete Checkout operation for this exact checkout. The Action does not complete the checkout, mint execution authority, or authorize any other operation.

The Business emits one instance only when the negotiated 2026-08-25 capability is active and an authoritative ESCALATE leaves human authority work outstanding for this checkout.

Processing and trust

• The Platform presents or opens config.continue_url for a human authority. It MUST NOT treat any other config or unknown field as executable content.
• Processing the Action does not repeat Complete Checkout. After the human interaction, the Platform obtains a later authoritative Checkout response before deciding what to do next.
• config.continue_url MUST use HTTPS. A Business integrator that supplies approval_url owns selection of that endpoint and its origin trust; Decionis validates HTTPS transport but does not claim to enforce a deployment allowlist. The Platform applies its own origin trust policy before navigation.
• The Platform MUST NOT send agent bearer tokens, payment credentials, raw checkout payloads, prompts, or secrets to the approval URL. The human authenticates at the approval origin.

Observation and failure

• The Business observes authenticated human-review evidence, re-evaluates the immutable checkout action, and reflects the result in a later Checkout response. The approval URL does not itself produce Presence evidence. When policy requires Presence, the Business MUST separately verify an exact-action Presence receipt and fail closed if it is absent or invalid. Browser completion, redirect completion, or approval submission alone is not proof that authority or the downstream effect exists.
• The Platform MAY retry a failed page load under a bounded local policy only when it has not observed a submission. It MUST NOT process an unchanged Action id again after a submission; it uses Get Checkout with bounded backoff to observe Business state.
• Processing MUST stop at config.expires_at when present, otherwise no later than the containing Checkout expires_at. A Platform MUST apply a finite local timeout and MUST NOT poll indefinitely.
• If unsupported, declined, abandoned, or timed out, the checkout remains held. The Platform hands off through the top-level continue_url when available; it MUST NOT infer ALLOW, complete the checkout, or convert ambiguity into success or failure.
• The same type and id remain while the same review is outstanding. The Business removes it only after later authoritative state resolves the work. Replacement work receives a new id, and an id is never reused during the checkout lifetime.
• Only one review instance is emitted for one outstanding Decionis review. Array order has no additional meaning and this Action defines no ordering for other Action types.

• No execution authority from an observational evaluation.
• An authority decision is not itself an execution grant.
• A consequential commit requires an exact-action ExecutionBinding and a pre-commit claim at the last responsible boundary.
• Presence supplies action-bound human evidence; Decionis re-evaluates it and Presence never mints execution authority.
• The UCP approval URL supplies an authenticated human-review handoff, not Presence. When policy requires Presence, an exact-action Presence receipt is separately verified and absence fails closed.
• COMMITTED does not mean CONFIRMED unless qualifying EffectEvidence records how the downstream effect was observed.

A Decision Dossier is canonical signed decision evidence. An ExecutionBinding is the separate exact-action authority commitment. The connected business claims it immediately before commit, performs the downstream action itself, finalizes the result, and may later attach typed EffectEvidence. A downstream acknowledgement can support COMMITTED, but it cannot by itself establish CONFIRMED.

UCP's signals object accepts vendor-namespaced keys, so a platform already holding a verdict can pass it to a business without either side negotiating this extension. The inbound object remains untrusted: a com.decionis.* name is not proof of origin or authority. Decionis verifies referenced evidence, commits only a privacy-safe digest/projection to dossier context, and does not retain raw buyer IP, user-agent, provider, credential, prompt, or secret values by default.

{
  "com.decionis.authority_verdict": "ESCALATE",
  "com.decionis.dossier_id": "…"
}

• allow.json
• escalate.json
• block.json
• signals.json
• This reference as JSON
• This reference as Markdown
• JSON Schema

Every artifact on this page is generated from one module, and validated against the live specification at ucp.dev before publication.

Why this layer exists · The protocol-agnostic view · Agent authorization reference