Comparisons
Placed correctly is half understood.
Agent mandate vs. OAuth scope
OAuth scopes govern technical API access; agent mandates govern legal authority to act. A scope says which endpoints a token may reach — a mandate says what an agent may do on behalf of which person up to which amount, readable by lawyers and provable.
Agent mandate vs. API key
An API key proves access, not authority: whoever holds it can do everything the key can — without limit, anonymously, until someone rotates it. A mandate proves an instruction: bound to an identity, limited in amount and time, revocable at any moment.
Mandact vs. AP2
AP2 solves agent payments: signed intent, cart and payment mandates for checkout — since April 2026 under the neutral governance of the FIDO Alliance, with v0.2 including autonomous human-not-present payments. Mandact solves agent actions: cancellations, data releases, bookings, procurement — with a European identity root and an evidence chain. AP2 payment mandates are encapsulated in Mandact as a payment.* subtype; FIDO's neutral governance makes this docking easier, not harder.
Intent mandate vs. action mandate
An intent mandate documents a specific intention: this basket, at this price, now. An action mandate documents standing authority: this class of action, up to these limits, for this term. Agentic commerce needs both — the intent for the transaction, the authority for the relationship.
EUDI wallet vs. Swiss E-ID
Both are state-anchored digital identities and equivalent identity roots for mandates. The EUDI wallet is the wallet EU member states must provide under eIDAS 2.0; the Swiss E-ID is Switzerland's counterpart under the E-ID Act (popular vote 2025).
Revocation vs. token expiry
Token-based systems end authority by expiry: until then the token is valid, whatever happens. Mandates end authority by revocation: the status is checked live on every verification, and a revocation takes effect without a grace period — even in the middle of a token's lifetime.
Attested vs. unattested agent
An attested agent carries its provider's confirmation (did:web) that it originates from and is operated by that provider. An unattested agent — a self-built one, for example — works technically the same, but verifiers can reject it by policy (MD-502).
Evidence chain vs. log file
Log files document what a system says about itself — one-sided, changeable, contestable in a dispute. An evidence chain documents what both sides have signed — hash-chained, timestamped, mathematically checkable for tampering.
Mandact vs. Okta for AI Agents
Okta for AI Agents (GA since 30 April 2026) answers the identity question: which agents exist in my company, what system access do they have, how do I withdraw it? For the same operator, Mandact answers the three questions that follow: who authorised this agent to do what, was exactly this action allowed to happen now — and where is the proof an internal audit can recompute without us? Identity says who acts. Mandact says whether they may act now.
Mandact vs. Stripe agentic commerce
Stripe's agentic commerce stack (ACP with OpenAI, Shared Payment Tokens, Machine Payments Protocol) is the developer rail for agent checkouts: scoped, time-limited, single-use — but only for payments, bound to Stripe accounts. Mandact governs the action behind and before it: whether the agent was allowed to buy, cancel or release data at all, on behalf of which legal person, with what proof.
The full feature matrix — 16 dimensions, five provider classes: open the matrix.