How can an AI agent buy a car for a user without dispossessing them?

An AI agent can buy a car for a user without dispossessing them by making its work auditable by construction, not by asking the user to trust it. Three properties do the load-bearing work. The agent reads the same record the user can read — verified Listings, each carrying venue, source, and timestamp — so there is no private surface the user is shut out of. It acts under a Mandate ceiling enforced in the wire format: every gate returns a typed OFFER with the ceiling in its shape, settled by x402 beneath it, or handed off via a typed NEEDS_HUMAN when a decision is legally or financially load-bearing — the limit is a wire fact, not a promise the agent remembers. And it returns a receipt — the evidence consulted, the actions taken, the price settled under the ceiling, and a dispute/refund URL. The human stays the principal; the agent stays the instrument. Delegation without dispossession is not a policy you write into a prompt — it is a shape you build into the wire.

That distinction is the whole design. Dispossession is what happens when an agent shops surfaces the user can't see, spends against a limit it merely holds in context, and hands back a log nobody can independently read. Every one of those is a place the user has to trust rather than check — and the first disputed deal is where trust runs out. "Trust the agent" is the answer that ends the account. The remedy is to remove the trust step at each point and replace it with something the principal can audit.

The three-step motion: read, act, return

The door's shape is a plan called read → act → return, and each step is defined by who is acting and under what authority.

Read. The agent reads the record under its Mandate's read scope. Each fact arrives as an evidence object — value, source, timestamp, verification — the same object whether a person opens the page or a machine negotiates JSON at that identical address. It reads verified Listings and nothing off-record: the corpus of 2.1M+ verified Listings, each carrying venue, source, and timestamp, is where the agent shops, and the count and corpus resolve at listings.vin. Nothing the user couldn't have read enters the deal.

Act. Every gate the agent hits returns a typed OFFER carrying the price and the hard Mandate ceiling — in the shape of the response, not in an instruction the model could drift past. The agent settles by x402 under the ceiling. Above the ceiling, the settlement simply fails; overspend is a settle error, not an apology after the fact. When a step is one the law or the money reserves for a human — an authorization, a signature, a consent — the gate returns a typed NEEDS_HUMAN Handoff carrying a signed, expiring URL, and the principal themself acts under their own signature before the agent resumes.

Return. The agent closes by returning the receipt: the evidence it consulted, the actions it took with who acted and under what authority, the price settled under the ceiling, and a dispute/refund URL. Done is a receipt the principal reads, not a log they take on faith.

The precision ladder: why the free read is the honest base

Non-dispossession also governs what the agent is allowed to claim it knows. The record answers on a precision ladder, and the ladder is quotable doctrine: an anonymous base any caller reads for free; an account tier that returns a range and a confidence when the agent is authenticated; and paid accuracy when the deal needs a point figure with a real source behind it. The agent should shop and reason on the free base first, and only spend against the ceiling to deepen a fact the deal actually turns on. Own-data-first means the free face leads and the metered face is a deliberate deepening step the receipt can show — not a default toll the user never sees. An agent that quietly pays for precision it didn't need has spent the principal's money without the principal's reason; the ladder makes that visible as its own receipt line.

One page, both readers

The property that ties it together is that there is no second, hidden surface. The page the user's agent reads is the page the user reads, and it is the same page the seller's desk reads — byte-identical across representations, one estate MCP at apis.vin/mcp whose tool results carry the door URL so the human twin travels with every machine result. This is the structural inversion of the desk: you have sat across a counter not knowing what the other side knows, and so has your user. Here neither side holds a private record. The check digit certifies the VIN; it never sells the car. When the agent reasons over a fact, the principal can open the identical fact at its address and see the same value, source, and timestamp.

The honest limit, and where the cost is

This door is the wiring diagram, and it sells nothing on its own page: the receipt renders free for any VIN, keyless, with no account — the capability is delegate any car moment by its VIN; your agent shops verified Listings, never crosses the Mandate ceiling, and returns a receipt the principal can read. The metered work lives downstream. The rails are priced at apis.vin with every unit price on the page; deal flow lands where the motion actually transacts, each step behind its own priced gate. The limit is deliberate and worth stating plainly: this door does not make the agent trustworthy — it makes the agent checkable. If you ship delegation whose receipt can't show its work, you have shipped the desk reborn inside your user's own tool, and you have become the desk. The design does not ask the principal to believe; it hands them the evidence and lets them audit.

The motion runs in production as a checklist on a VIN — B2A2C alongside B2H2A — at buy.vin, where read, act, and return execute end to end. When the deal has a sell side, the offer, the payoff, and the net-to-you are shown before the principal accepts at offers.vin. And the delegation contract itself — the receipt rendered live for any VIN — is b2a2c.vin.