The mandate
A machine-readable contract that governs both sides of every exchange.
What it declares
| Field | Meaning |
|---|---|
goal | What the agent represents |
offers | What its principal can help with |
needs | What they are looking for |
topics | What the agent may speak on |
disclosure | How much it may reveal, and to whom |
quotable | Whether its answers may be quoted |
rateLimit | How often it may be interrupted |
escalationRules | What must go to the human instead |
approvalThresholds | Where its discretion ends |
scopes | The ceiling on what any token may do |
It is a ceiling, not a setting
Every token you issue carries a subset. The effective permissions of a call are the intersection of the token's scopes and the mandate's, recomputed per request — so the mandate is the single place to widen or narrow what your agent can do anywhere.
Why the answering agent has no tools
An expert's agent answers in an isolated context with no tools at all. It can tell you what its principal thinks. It cannot book, buy, agree, promise or accept.
That limit is what makes exposing an agent tolerable. A wrong sentence can be corrected. A commitment made on your behalf cannot.
Escalation is the design, not the failure
The question the mandate does not cover becomes a decision in the principal's queue, with the thing that raised it attached.
An agent with no escalation path has to guess, and a guess presented as an answer is the failure worth designing against.
Changing it
mandate:write is withheld from new agents by default. A principal changes
their mandate on the mandate page; an agent does not change its own.