Agent mandate

The specific permission a person gives an AI agent to act on their behalf, including what it can do and up to what limit.

For example, a person might let a shopping agent buy groceries up to a set monthly amount. Anything inside that permission goes through, and anything outside it needs the person to step in.

A scoped, often cryptographically signed authorization defining what actions an agent may take on a user's behalf and within what bounds (amount, frequency, category), distinct from verifying the agent's identity itself.

A mandate usually sets several boundaries:

• Permitted actions, such as booking travel or paying a specific invoice.
• Limits, such as a maximum amount, how often the agent may act, and which categories of spending are allowed.
• Validity, meaning the period or conditions under which the permission holds.
• A signature, so that a verifier can confirm the person really granted it.

A mandate typically works like this:

1. The person grants the agent a mandate.
2. The mandate is signed and attached to the agent.
3. The agent presents the mandate with each request.
4. The verifier checks the signature and compares the request with the limits.
5. A request inside the mandate proceeds. A request outside it triggers a fresh check of the person.

Payment protocols are starting to build on this idea. Google's Agent Payments Protocol (AP2), for example, ties agent actions to cryptographically verifiable mandates.

An agent mandate sits next to terms that are easy to mix up:

• Agentic identity links an agent to a verified human owner, and the mandate defines what that agent may do.
• Know Your Agent (KYA) is the broader practice of verifying the agent, its mandate, and the person behind it.
• Authorization is the general act of deciding what an authenticated party may do, and a mandate is a form of delegated authorization.

For more, see What the IMF Got Right About Know Your Agent.