Delegation with a
cryptographic ceiling.
Not every agent action can wait for a human. A mandate is a signed grant that says exactly what this agent may do, up to what limit, until when. The agent spends authority inside those bounds and cannot widen them, extend them, or reissue them to itself.
The agent gets autonomy. The human keeps the boundary, and the boundary is signed.
Standing credentials have no ceiling.
An agent is given an API key, a service account, or a long-lived token so it can operate without interruption. That grant carries no limit that survives contact with the agent: no amount cap it enforces, no expiry it respects, no scope it cannot reason its way around. When it acts outside what anyone intended, nothing in the credential says it did.
Service accounts and API keys
A bearer secret. Whoever holds it has everything it grants, for as long as it exists. Scope is defined at issuance and never re-checked against intent.
OAuth scopes
Coarse and static. 'payments:write' does not encode a ceiling, a counterparty, or an expiry. The scope that permits a five-dollar refund permits a five-million-dollar one.
Rate limits and spend caps in config
Enforced by the same system the agent is operating inside. A configuration value is not evidence, and it is not signed by the person accountable for the limit.
Agent framework permission files
Read by the model as context. Instructions in the environment are input, and input is something a sufficiently capable agent negotiates with.
One human signature defines the bounds. Every action inside them is receipted.
The mandate is issued once, by a person, in a sealed Authoritative-tier ceremony. What follows is autonomous and still accountable.
The human signs the mandate
Scope, ceiling, counterparty constraints and expiry are rendered on the enrolled device and signed with the hardware-bound key. This is the one moment a human is required.
The agent receives a bounded grant
Your backend holds the signed mandate. The agent gets a handle to it, never the signing material. It cannot read, copy or extend the authority it is spending.
Each action is checked against it
Every call the agent makes is evaluated against the signed bounds. Over the ceiling, outside the permitted action types, or against a counterparty the holder did not list, the call stops and goes to the human rather than proceeding on the mandate. Past the expiry, or with no mandate at all, it fails outright.
Every action leaves a receipt
Each permitted action produces a ledger entry chained to the mandate that authorized it and to the human who signed that mandate. The signature on the mandate is the human's, made on their own device; the per-action entry is countersigned by the server against that mandate. The trail reconstructs without interpretation.
The mandate, and every action spent against it.
mandate_id
The signed grant this action was taken under. Every receipt points back to exactly one mandate, and every mandate to exactly one human signature.
scope
The enumerated action types the agent may perform. Not a role name. The specific operations, fixed at signing time.
ceiling
The quantitative limit, cumulative across the mandate's life: total amount, call count, record volume. Enforced server-side, not by the agent.
expires_at
Hard expiry. Past it the mandate is dead and cannot be renewed by the agent; renewal requires a fresh human signature.
granted_by
The device key of the human who signed. Attribution survives staff turnover, credential rotation and the agent being retired.
spent
Running total consumed against the ceiling. Queryable at any moment, including mid-incident.
Where bounded autonomy earns its keep.
Agentic commerce
An agent that buys, refunds or reconciles on a customer's behalf, inside a limit that customer signed and a dispute process can produce.
Automated remediation
An SRE agent permitted to restart, scale and roll back, but not to delete, without a fresh press for the destructive class.
Back-office processing
High-volume claims, approvals or postings running unattended, with a signed ceiling that caps the blast radius of a bad model day.
Answered plainly.
How is a mandate different from a scoped token?
A scoped token is issued by your infrastructure and asserts what it was issued for. A mandate is signed by a named human on hardware they hold, carries quantitative limits your server enforces, and produces a receipt chain that binds every action back to that person. One is configuration. The other is evidence.
What stops the agent from requesting a new mandate when it hits the ceiling?
Issuing a mandate is itself an Explicit-tier action. It requires a fresh biometric signature from the enrolled human on the bound device. An agent asking for more authority produces a prompt to a person, which is exactly the intended behaviour.
Can a mandate be revoked mid-flight?
Yes. Revocation is immediate and server-side. The agent's next call is refused regardless of what it holds locally, because the check runs against your ledger, not against a cached grant.
What if the agent is compromised?
It can act, but only inside the signed bounds, only until expiry, and only up to the ceiling. Every action it takes is receipted and attributable. You get a bounded loss and a complete trail, instead of an unbounded one and an inference.
Does this work for multi-agent systems?
Yes. A mandate is bound to an agent identity, so a supervising agent cannot pass its authority to a subordinate. Each agent that needs authority holds its own mandate, and each mandate traces to a human.
Put it on one flow first.
Tell us the action you need proof for. We come back with a working integration proposal and a signed sample you can verify yourself. First call within five business days.