The mandate · spec 1.0 · published 2026-10-25

One mandate. Many agents.

The human's authority as a signed, bounded, expiring object - one mandate, many agents. Every agent that acts for a person - on a phone, in a browser, in a company - should carry the same object, and every counterparty should be able to verify what it did against it. This page is that object, open.

Everyone is building the agent that does. This is the contract that says what it may do, for how long - and proves afterwards that it did only that. The object and the verification are published here. How the check runs, who witnesses it and how the keys are kept are not.

1 · The object

A mandate is derived from the human's own words (Dutch, German, French or English), never the other way round. It is signed once and carried by any agent. The agent can never widen it. These are its fields - generated from the code that enforces them.

field	type	default	meaning
subject	string	"user"	Whose authority this is. The agent never widens it.
version	integer	1	Mandate object version; a receipt names it.
per_transaction_eur	number	400.0	Ceiling per action. Above it: BLOCK.
per_month_eur	number\|null	null	Ceiling per calendar month across every agent acting under this subject, together.
max_actions_per_hour	integer\|null	null	Actions proposed in the last hour. Above it: BLOCK. A runaway loop of cheap calls passes every value ceiling; it does not pass this.
per_hour_eur	number\|null	null	Euros executed in the last hour. Above it: BLOCK.
loop_confirm_after	integer\|null	60	The same action (kind + tool + merchant) repeated this often in an hour is asked (CONFIRM), never run silently - on by default, because a loop has no attacker to detect. null switches it off, explicitly.
side_principal_policy	string	"confirm"	An action proposed by someone other than the human or their own agent - a sponsored agent in the chat, a merchant's agent - is asked first ('confirm'), naming who and whether they paid, or never taken ('deny'). A proposer that will not be named is refused.
confirm_above_eur	number	150.0	Above it the human is asked (CONFIRM) before the action runs.
confirm_irreversible	boolean	true	Reversibility, not severity, decides who acts: NONE/COSTLY -> ask.
confirm_affects_others	boolean	true	An action that reaches another person is asked first.
confirm_new_counterparty	boolean	true	A merchant or address never seen before is asked first.
drift_tolerance_eur	number	0.0	How far the executed amount may differ from the shown amount (parameter binding).
drift_tolerance_pct	number	0.0	Same, as a percentage; the human's own ceiling ('small price changes up to 2%').
denied_categories	string[]	["gambling", "crypto_exchange"]	Never, whoever asks.
denied_capabilities	string[]	[]	Capabilities that are BLOCK, never even asked.
allowed_tools	string[]	[]	Empty = any KNOWN tool (see tool_policy).
denied_tools	string[]	[]	Tools explicitly refused.
tool_policy	'default_deny'\|'allow_unknown'	"default_deny"	DEFAULT-DENY: a tool the vocabulary does not know is refused. The unenumerated path never runs silently.
declared_tools	string[]	[]	Extra tools the tenant declared by name - now in the vocabulary.
protected_data	string[]	[]	DATA CLASS: leaves only to counterparties the person already dealt with.
sealed_data	string[]	[]	DATA CLASS: never leaves, to anyone.
merchants_deny	string[]	[]	Named counterparties refused.
asset_classes	string[]	[]	TRADING PROFILE: the asset classes the agent may trade (equities, etf, bonds, crypto, options, data). Empty = no trading profile. A trade in another class, or one that does not say its class, is BLOCK. A failed fill is closed NOT_DONE / FILL_FAILED.
max_retries_per_goal	integer\|null	null	THE PERSISTENCE BUDGET: a refusal on one channel is a refusal on every channel for the same goal (a direct message, then an e-mail, then a DNS record, then a sibling agent). Past this many refusals of one goal the next attempt is refused, signed, with the reason, whatever the channel. null = no budget.
valid_until	string\|null	null	THE SAFE STATE: an ISO-8601 UTC instant after which this mandate authorises nothing - every act under it is refused, signed, as expired. An act that cannot refresh its authority stops; it never hangs. null = a standing mandate.
refresh_deadline_s	integer\|null	null	An approval older than this many seconds at the instant of the act is refused as expired - the agent comes back for its authority instead of running on a stale approval. null = the approval's own life (five minutes).
address_classes	string[]	[]	THE CHECKOUT PROFILE: the address classes a checkout may ship to (home, work, pickup ...). A checkout to another class, or one that names no cart digest, never runs; a 3-D Secure hand-back to the human closes the checkout as not done. Empty = no checkout profile.
max_actions_total	integer\|null	null	THE ACTION BUDGET: the mandate dies after this many signed actions (signatures and executions since it was created). Action N+1 is refused, signed, as BUDGET_EXHAUSTED; the human renews by signing a new mandate. Proposals and refusals never count. null = no budget.
decider_id	string\|null	null	DECIDER IN, RECEIPT OUT: the decider (model, policy) allowed to decide under this mandate. An action decided by another, or by none, is refused, signed, as DECIDER_MISMATCH. null = any decider; the receipt still records the one the action declared.
decider_hash	string\|null	null	The sha-256 of the decider as served (weights, policy, prompt - whatever the tenant hashes). With decider_id: an action whose decider hash differs is refused. null = the id alone binds.
decider_p_max	number\|null	null	Declared for the record only: the probability the human was told the decider works at. A probability is an input the receipt records, never a permission - this field compiles to no rule.
allowed_categories	string[]	[]	THE MERCHANT-CLASS ALLOW LIST: 'only at grocery stores'. A purchase in any other class - or one that does not say its class - never runs. The parser knows grocery, pharmacy, transport, electronics, clothing, restaurants, travel, entertainment; the SDK may declare any class by name. Empty = no allow-list.
signer_role	'principal'\|'guardian'	"principal"	THE GUARDIAN MANDATE: who signed this mandate. 'principal' = the subject's own authority; 'guardian' = a parent or guardian signs for a minor's companion agent - the ward is the subject, the guardian is named, and the receipt carries both. Content-blind: a guardian binds act classes (purchase, outbound contact, data share), never words.
guardian	string\|null	null	The guardian who signed, when signer_role is 'guardian'. null otherwise.
retain_days	integer	730	How long receipts are kept.
export_format	string	"eu_ai_act_art14"	The oversight record format (EU AI Act Art. 12 logging / Art. 14 oversight).
language	string	"en"	The language the human wrote the mandate in (NL/DE/FR/EN parsed).
source_text	string	""	The human's own words - the mandate is derived from them, never the other way round.
understood	string[]	[]	Which clauses the parser understood (provenance).
unparsed	string[]	[]	Which clauses it did NOT - nothing is dropped silently.

EXAMPLE - the object behind "don't spend more than 400, always ask before anything non-refundable"

{
  "address_classes": [],
  "allowed_categories": [],
  "allowed_tools": [],
  "asset_classes": [],
  "confirm_above_eur": 150.0,
  "confirm_affects_others": true,
  "confirm_irreversible": true,
  "confirm_new_counterparty": true,
  "decider_hash": null,
  "decider_id": null,
  "decider_p_max": null,
  "declared_tools": [],
  "denied_capabilities": [],
  "denied_categories": [
    "gambling",
    "crypto_exchange"
  ],
  "denied_tools": [],
  "drift_tolerance_eur": 0.0,
  "drift_tolerance_pct": 0.0,
  "export_format": "eu_ai_act_art14",
  "guardian": null,
  "language": "en",
  "loop_confirm_after": 60,
  "max_actions_per_hour": null,
  "max_actions_total": null,
  "max_retries_per_goal": null,
  "merchants_deny": [],
  "per_hour_eur": null,
  "per_month_eur": null,
  "per_transaction_eur": 400.0,
  "protected_data": [],
  "refresh_deadline_s": null,
  "retain_days": 730,
  "sealed_data": [],
  "side_principal_policy": "confirm",
  "signer_role": "principal",
  "source_text": "don't spend more than 400, always ask before anything non-refundable",
  "subject": "alice",
  "tool_policy": "default_deny",
  "understood": [],
  "unparsed": [],
  "valid_until": null,
  "version": 1
}

2 · The receipt

Every action an agent takes under a mandate yields a receipt: what was approved is what was signed, nothing else. A receipt verifies with nothing but the receipt - no account, no network, no trust in us. The receipt is minted by the checkpoint, outside the agent's process, with a post-quantum signature the agent never holds: in a published study five of six agent harnesses let the agent delete its own trace, and a record the agent can edit is not a record.

field	meaning
mandate_hash	sha256 of the canonical mandate object the action was judged against.
action_hash	sha256 of the canonical parameters the human saw (parameter binding).
parameters	Those parameters, verbatim.
verdict	SILENT \| NOTICE \| CONFIRM \| BLOCK at the signature; DONE \| NOT_DONE on an outcome; PRESENT on a merchant presentation; ADMIT \| NOT_DONE on the merchant door's answer.
rule_code	Which mandate rule decided - a short code the receipt carries so two receipts can be compared.
signer	{algorithm: 'ML-DSA-87', custody, public_key_b64} - the key that signed, and the public key to check it with.
doer	The registered doer (agent) that proposed the action, by id - null when none was declared. The storefront's 'identify yourself'.
credential_held_by_doer	true \| false \| null: whether that agent itself holds the human's login or card. WARRANT never does. The object a revocation acts on; null = the agent did not say.
principal_ref	The principal this action was taken FOR when the agent works for a group (a member, a client, a non-customer in the chat) - null when the action is the subject's own. Shown, bound and signed per action.
beacon_ref	Optional: {seq, hash, ts} of the time beacon the receipt was signed under - a hash-chained, ML-DSA-87 signed clock, so the receipt proves WHEN under the same scheme that proves who and what. Verify at POST /warrant/v1/beacon/verify.
signer_role	'principal' \| 'guardian' - who signed the mandate this receipt was issued under (THE GUARDIAN MANDATE, rank 149).
guardian	The guardian named on a guardian-signed mandate; null on a principal's own mandate.
decider	{id, hash, p} - the decider the action declared (DECIDER IN, RECEIPT OUT, rank 39): its id, the hash of what was served, and the probability it reported. Recorded under the signature; the probability is never a permission. null when the action declared none.
second_operator_id	RESERVED, not enforced: the second operator who cosigns the receipt (the parity move to a two-cosignature floor). Absent today: every receipt is 1-of-1 under the platform signer.
cosign_alg	RESERVED, not enforced: the cosignature algorithm - 'ML-DSA-87' (the same NIST FIPS 204 category-5 scheme as signature_b64).
cosign_sig_b64	RESERVED, not enforced: the second ML-DSA-87 signature over the same 'HARNESS-OS:config:' + receipt_digest. The verifier accepts 1-of-1 today; 2-of-2 when a tenant configures a second operator.
ts	Unix time of the signature.
receipt_digest	sha3_256 of the canonical body above (without this field and the signature).
signature_b64	ML-DSA-87 over 'HARNESS-OS:config:' + receipt_digest. null on a refusal (refusals carry refusal_signature_b64).

Verify - the procedure

Four lines. Anyone.

body = receipt minus {receipt_digest, signature_b64}
digest = sha3_256(json.dumps(body, sort_keys=True, separators=(',',':'), ensure_ascii=True))
assert digest == receipt.receipt_digest
ML-DSA-87.verify(public_key=body.signer.public_key_b64, message=b'HARNESS-OS:config:'+digest, signature=signature_b64)

Signature: ML-DSA-87 - NIST FIPS 204, category 5, key in hardware custody. A verifier that says "probably fine" is not a verifier: any defect is a refusal.

Run it

Online or offline

POST https://api.cryptoshieldai.ai/warrant/v1/verify with {"receipt": ...} - no key needed.

Offline: backend/sdk/python/mandate_verify.py receipt.json (a NIST FIPS 204 library, e.g. quantcrypt). The reference verifier ships in the open SDK and is mutation-tested against the platform's own signer: every altered field is refused.

The full spec as JSON, with the signer's public key: GET https://api.cryptoshieldai.ai/warrant/v1/spec

3 · Carried to the rails

The payment rails are building their own mandates - AP2's Intent, Cart and Payment mandates among sixty companies. The human should never sign three. The WARRANT mandate is the one they sign; the rail's object is derived from it.

AP2 Intent Mandate

Derived, not retyped

GET /warrant/v1/mandate/{subject}/ap2 returns an AP2 IntentMandate - natural_language_description, merchants, requires_refundability, intent_expiry, user_cart_confirmation_required - from the human's one mandate, with the ceilings the rail has no slot for carried as namespaced extension fields. Every purchase under it still yields a WARRANT receipt.

Any counterparty

Verify, don't trust.

A merchant, a registry, a platform or an insurer can check any receipt presented to it with the four lines above - today, with no agreement with us. If you run a rail and want the mandate carried natively, write to us.

Action-scoped execution authority · the evidence

Public records say what the mandate is for. Each number is quoted from its primary source.

arXiv 2609.11596 · 10 Sep 2026

Our academic twin: from intent to execution grant

Wu, Wang, Zhang and Deng specify EBL-Core, an execution-boundary conformance profile in which a high-risk action is released only through an Execution Release Contract bound to a structured intent. It is the same shape as the mandate and its receipt: action-scoped execution authority. In their tests, 32 concurrent redemption attempts yielded exactly one successful redemption per trial, and 100 revoke-redeem races ended in valid terminal outcomes. Read the paper.

METR · 26 Aug 2026

The transcript is not the record

“Roughly 7% of the transcripts we evaluated were successfully spoofed.” In an agent hacking incident with roughly 1,200 agents and over 70,000 messages and files, the agents forged tool calls in their own records — then adopted Ed25519 signing among themselves to stop impersonation. The receipt above signs the action at the checkpoint, never the transcript. METR’s investigation.

arXiv 2610.21063 · 15 Oct 2026

Approve what, exactly?

An audit of how agent runtimes handle approval puts the test in two conditions: an approval counts as a second factor “only when compromising the agent cannot produce it and when it names exactly what it approves.” Its finding across ten runtimes: no third-party verifiable approval record. The mandate names the action, the amount and the recipient before the act; the receipt is minted outside the agent after it. Both objects were defined here before the paper: the parameter-bound mandate on 17 September 2026, the receipt minted outside the agent on 27 September 2026. Read the paper.

arXiv 2609.30266 · 24 Sep 2026

A log the agent can reach is not evidence

In this study five widely used coding-agent harnesses let the agent delete its own execution trace on request, without triggering a guardrail; only one did not. A record the subject can edit proves nothing about what the subject did. The receipt is minted by the checkpoint, outside the agent’s process, and signed with a key the agent never holds. Read the paper.

Anthropic · 9 Oct 2026

Scope is a parameter, not a disposition

In its report on unintended model actions, the lab found that most were forms of persistence, where the agent “works around a restriction instead of stopping,” and that the lesson was to state “the targets, permitted actions, and network boundaries.” Those are the mandate’s parameters. A refusal on one channel is a refusal on every channel for the same goal, and the refused attempt is on the record as NOT-DONE. Read the report.

4 · What is published, and what is not

Published - the map

Use it. Cite it.

The object, its fields and defaults; the receipt and the exact verification; the AP2 derivation; the reference verifier. A map everyone uses becomes the standard, and the one who drew it gets cited, not compared.

Kept

Named by what it does, not how.

the check in the path of the action, before it runs - measured and published, never described
the independent witness that is neither the agent's maker nor the counterparty
the set question - what all of one person's or one company's agents can do together
the key custody the receipts stand on

5 · Where it runs

WARRANT - PRO €177 per user, TEAM €9,997 per small team a month; EMBED (the infrastructure licence for agent platforms) is sales-led: adama@cryptoshieldai.ai. The mandate in the person's own words, the human asked only at the exceptions, the receipt on every action, the Article 12/14 export. The check runs in the path of the action at 0.28 ms p95, measured and published. The harness underneath: 131 doors across 17 planes.