What is an agent mandate?
Last updated: · Leutrim Miftaraj
An agent mandate is a machine-verifiable, legally worded declaration by a legal person that a specific AI agent may perform defined actions on its behalf — limited by action, amount, frequency, counterparty and time, revocable at any moment, provable for both sides.
The three components
Identity (who grants authority — anchored in the E-ID/EUDI wallet or an organisational register), scope (exactly what, within which limits — as structured constraints) and legal text (the legal wording, bound inseparably to the credential via SHA-256). If one is missing, it is not a mandate but an API key with hope attached.
How it differs
An OAuth scope governs technical access to endpoints; a mandate governs legal authority towards third parties. A payment mandate (AP2) authorises a payment; an agent mandate authorises actions — from a cancellation to a request to an authority — and can contain payment mandates as a subtype.
Lifecycle
Draft → signature (for organisations: four eyes above a threshold) → active → consumed/expired/revoked. The state machine is deterministic; terminal states are final — a revoked mandate can never become active again.
Key takeaway
Mandate = identity + scope + legal text, machine-verifiable and revocable. Everything else is access, not authority.
Try it yourself
Issue your first agent mandate and check your first decision with its receipt — free, in a few minutes.