drift: continuous mandate enforcement for AI agents
🛡️ drift — continuous mandate enforcement for AI agents An agent is granted a mandate: who to pay, how much, in which currency, until when. AP2 verifies that mandate once, at signature time. After that the agent acts alone. This is not theoretical. In Google's AP2 Python SDK, verify_chain documents that it enforces expected_aud on the terminal hop. But verify_expected_claims runs only when typ…
The continuous mandate enforcement system, known as "drift," ensures that AI agents follow the rules governing their spending authority. An agent is given a mandate specifying who to pay, how much, in which currency, and the time frame for the transaction. The protocol trusted by the agent does not verify if the authority has been substituted. To address this issue, drift enforces six rules before any action is taken, with a default denial policy in place.
The rules include checks on the amount, payee, audience, currency, time window, and intent. These rules are enforced through three functions: drift_check, drift_session, and drift_explain, all implemented in the standard library. The system is free to use, allowing for 100 checks per day without requiring any registration.
The drift system was developed following an analysis that revealed a critical flaw in Google's AP2 Python SDK. The SDK's verify_expected_claims function only runs when the transaction type is TYP_TERMINAL, which means that tokens minted for different audiences are accepted, bypassing the expected audience check. This gap in the protocol allows for potential misuse of AI agents' spending authority.
The drift project provides a comprehensive defect analysis and a reproducer with full test coverage on its GitHub repository. With a robust implementation of drift, AI agents can better ensure that their spending authority is securely enforced, preventing unauthorized transactions and maintaining trust in the system.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
