Comparison
Agent mandate vs. OAuth scope
OAuth scopes govern technical API access; agent mandates govern legal authority to act. A scope says which endpoints a token may reach — a mandate says what an agent may do on behalf of which person up to which amount, readable by lawyers and provable.
| Dimension | Agent mandate | OAuth scope |
|---|---|---|
| Answers | What may the agent do legally, on whose behalf? | Which API resources may the token reach? |
| Identity binding | State root (EUDI/E-ID, organisational register) | Account with the respective service |
| Amount/frequency limits | Native, reserved atomically | Not provided for |
| Legal wording | Inseparably bound (hash) | Does not exist |
| Revocation | Effective from the next check, status checked live | Token expires or is invalidated (latency depends on the service) |
| Proof in a dispute | Two-sided, timestamped evidence chain | The provider's server logs |
| Relationship | Runs alongside OAuth: the mandate is presented as an SD-JWT VC (OID4VP) or checked via /v1/verify | Remains the transport for technical access |
Verdict
Not either-or: OAuth governs technical access, the mandate governs legal authority. The verifier additionally checks the mandate — via OID4VP or /v1/verify — and gains legal certainty without rebuilding its OAuth access. An earlier bridge that embedded mandates in OAuth tokens (RFC 9396) is withdrawn (410 Gone): tokens held in process memory and a missing tenant binding would not have carried the promise.