Mandates and AutoPay · TatvaPay Docs

Coming next. TatvaPay mandates, caps, approvals, the consent centre and signed receipts work in the sandbox (fake rails, no money moves). Bank mandates (UPI AutoPay and e-mandates) are being built with the first planned payment integration, Razorpay, in test mode. UPI Reserve Pay is planned. Nothing is live in production.

A TatvaPay mandate works like the AutoPay a person sets up for a subscription, but for one AI agent. The person authorises it once; after that the agent can pay only inside its limits, and the money stays in the person's bank account until a payment is made.

Two layers

Layer	What it knows	Who runs it	Status
TatvaPay mandate	Which agent, caps per payment and per period, merchants or categories, expiry, the approval threshold	TatvaPay (rules in code, versioned)	Next (sandbox)
Bank mandate	A maximum amount and frequency the bank will debit	NPCI and the person's bank, through a licensed payment aggregator	Next (being built), Planned for Reserve Pay

A payment goes through only if it fits both. The bank mandate alone cannot tell which agent is paying or for what; the TatvaPay mandate adds that.

The lifecycle

Draft. An agent (or the app) proposes a mandate: caps, categories, expiry. Agents can ask for one with the MCP tool request_mandate; they cannot authorise it.
Authorise. The person reads the consent wording and authorises once. The exact wording version and its hash are recorded with the mandate. For a bank mandate, the person also approves it in their UPI app or netbanking, as with any AutoPay.
Active. The agent pays inside the caps. Every payment is checked by the rules engine and lands in a hash-chained, signed receipt.
Ends as exhausted (caps used up), expired or revoked (by the person, in the consent centre or, for UPI AutoPay, in their UPI app).

The ₹2,000 rule

Above a threshold, ₹2,000 by default, the person is always asked, whatever the mandate allows. An agent cannot raise the threshold. Merchant agents' retries of a failed charge (Payment Recovery) always wait for a named person on the merchant's staff, at any amount.

The bank rails

Rail	In one line	Status
UPI AutoPay	A recurring UPI mandate approved once with the UPI PIN; later debits stay within the approved maximum, usually with a notice before each debit	Next (being built, test mode)
e-mandate	The same idea through netbanking or a debit card	Next (being built, test mode)
UPI Reserve Pay	An amount blocked in the person's account for an agent; payments are taken from the block as needed	Planned (when the payment aggregator enables it)
Card agent tokens	Network tokens scoped to an agent	Planned

Maximum amounts, pre-debit notices and when extra authentication is needed are as set by NPCI and your bank. They change over time; we do not repeat numbers here.

Mandates from other protocols

Mandates created over ACP (delegated payment on a UPI mandate) and AP2 (open and closed mandates) are mapped onto the same model, carry their source, and show up in the consent centre with one-tap revoke.

Who holds what

TatvaPay holds no RBI licence and never holds funds. Bank mandates and debits are run by licensed payment aggregators (first planned integration: Razorpay). See Trust and security.

Related: Mandates (the data model), Consent centre, How mandates work (plain-language guide).