What happened?
Description
AP2 requires the Agent Provider to ensure that the Agent cannot access the provider signing key or use it without the Trusted Surface.
The official Python/Web sample violates this boundary: the shopping-agent module loads/generates the Agent Provider private key, signs open checkout/payment mandates from Agent-supplied JSON, and exposes this signing path as an ADK agent tool.
The Web Trusted Surface is presentation-only and returns a plain mandate_approved message to the Agent, not a signer-verifiable consent artifact.
Impact
Implementers following this sample may place the Agent Provider signing key and open-mandate signing capability inside the Agent execution domain.
Provider-signed open mandates can then be produced from Agent-supplied content without independently verifiable Trusted Surface consent. Downstream verification may still succeed because the real provider key was used.
Steps to Reproduce
-
Review docs/ap2/agent_authorization.md:301-312 and docs/ap2/specification.md:78-98. The Agent must not access or use the Agent Provider signing key without a non-agentic Trusted Surface.
-
Review code/samples/python/src/roles/shopping_agent_v2/shopping_agent/mandate_tools.py:201-224 and :347-418. The shopping-agent module obtains the Agent Provider private key, and assemble_and_sign_mandates() can sign open checkout/payment mandates from ordinary mandate fields such as item_id and price_cap; it does not require a Trusted Surface consent assertion.
-
Review code/samples/python/src/roles/shopping_agent_v2/shopping_agent/mandate_tools.py:421-481 and code/samples/python/src/roles/shopping_agent_v2/shopping_agent/agent.py:229-232. The signer is registered directly as assemble_and_sign_mandates_tool on the shopping agent.
-
Review code/web-client/src/trustedSurface.ts:1-9 and code/web-client/src/hooks/useChat.ts:510-519. Approval is returned to the Agent as mandate_approved, not as a consent assertion verified by the signer.
Relevant log output
Code of Conduct
What happened?
Description
AP2 requires the Agent Provider to ensure that the Agent cannot access the provider signing key or use it without the Trusted Surface.
The official Python/Web sample violates this boundary: the shopping-agent module loads/generates the Agent Provider private key, signs open checkout/payment mandates from Agent-supplied JSON, and exposes this signing path as an ADK agent tool.
The Web Trusted Surface is presentation-only and returns a plain
mandate_approvedmessage to the Agent, not a signer-verifiable consent artifact.Impact
Implementers following this sample may place the Agent Provider signing key and open-mandate signing capability inside the Agent execution domain.
Provider-signed open mandates can then be produced from Agent-supplied content without independently verifiable Trusted Surface consent. Downstream verification may still succeed because the real provider key was used.
Steps to Reproduce
Review
docs/ap2/agent_authorization.md:301-312anddocs/ap2/specification.md:78-98. The Agent must not access or use the Agent Provider signing key without a non-agentic Trusted Surface.Review
code/samples/python/src/roles/shopping_agent_v2/shopping_agent/mandate_tools.py:201-224and:347-418. The shopping-agent module obtains the Agent Provider private key, andassemble_and_sign_mandates()can sign open checkout/payment mandates from ordinary mandate fields such asitem_idandprice_cap; it does not require a Trusted Surface consent assertion.Review
code/samples/python/src/roles/shopping_agent_v2/shopping_agent/mandate_tools.py:421-481andcode/samples/python/src/roles/shopping_agent_v2/shopping_agent/agent.py:229-232. The signer is registered directly asassemble_and_sign_mandates_toolon the shopping agent.Review
code/web-client/src/trustedSurface.ts:1-9andcode/web-client/src/hooks/useChat.ts:510-519. Approval is returned to the Agent asmandate_approved, not as a consent assertion verified by the signer.Relevant log output
Code of Conduct