Mandate Continuity Under Adversarial Storefront Content: Does Verifiable Authorization Establish Faithful Execution in Autonomous Commerce?

Autonomous shopping agents operate across a security boundary that conventional e-commerce did not have to manage in the same form: commercial content used to decide what to purchase may itself be controlled by parties whose interests differ from those of the user. MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks establishes indirect prompt injection as a concrete web-agent security problem, while Agent Payments Protocol (AP2) introduces explicit mechanisms for representing and verifying user authorization in agent-led commerce. This paper asks a narrower question: does possession of an authentic, integrity-protected purchasing mandate establish that an agent's eventual transaction remains faithfully derived from that mandate after the agent processes potentially adversarial external information? I introduce mandate continuity as a candidate security property and authority drift as a hypothesis to test, not an established attack category. The proposed failure condition occurs when an agent remains properly authorized to transact and a proposed purchase passes designated execution controls, yet independent evaluation finds that the purchase violates a constraint originating in the user's frozen mandate. A controlled experiment is proposed in which the user mandate and authoritative product facts remain fixed while designated merchant-controlled inputs vary. The experiment compares model-level controls, conventional transaction controls, verifiable-mandate controls, and independent mandate-continuity verification. It additionally treats digital-forensic observability as a prerequisite for causal attribution: transaction records may establish that a divergent action occurred, but attributing the divergence to adversarial storefront content requires evidence of what information actually entered the agent's observation state. Negative findings remain meaningful. Authority drift may prove empirically indistinguishable from existing prompt-injection, integrity, authorization, or evidence-corruption failures, or continuity verification may provide no measurable benefit beyond existing mandate mechanisms.