Issue a commercial mandate
issue_mandateIssue and sign a commercial mandate to define an agent's authority, scope, spending limits, and validity period. Call once per acting agent before any other tool.
Instructions
Issue and sign a commercial mandate: the document stating which organisation an agent represents, which acts it may take, under which limits, for which transaction or category, and for how long. Call this once per acting agent before anything else. Every other tool names the mandate an agent acts under.
A spending_limit becomes two explicit constraints, an amount ceiling and a currency, both visible in the audit record.
The mandate is checked before it is signed, so a refused one never receives a signature that would make it look issued. Refusals: no constraint at all (A202-MANDATE-UNBOUNDED), a scope naming neither a transaction nor a category (A202-MANDATE-SCOPE-TOO-BROAD), an inverted validity interval (A202-MANDATE-INTERVAL-INVALID), a status endpoint that is not HTTPS (A202-MANDATE-STATUS-INSECURE), a subject naming both an agent and a principal (A202-MANDATE-SUBJECT-AMBIGUOUS).
Returns the mandate identifier and the signed document.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | The boundary of the authority. Must carry transaction_ids, categories, or both. Counterparty and geography narrow an existing boundary and cannot establish one, so a scope naming only a country is refused. | |
| issuer | Yes | The principal issuing the authority, and the key it signs with. | |
| actions | Yes | The acts the subject may take, for example offer.submit, offer.accept, agreement.sign. Deny by default: an omitted act is not allowed. | |
| subject | Yes | Who acts under the mandate: exactly one of an agent or a delegated principal, never both. | |
| delegation | No | Optional, defaults to no delegation. allowed false requires maximum_depth 0; allowed true requires at least 1. An incoherent pair is refused rather than interpreted. | |
| mandate_id | No | Optional explicit identifier, prefixed mnd_. One is minted when absent. | |
| valid_from | Yes | RFC 3339 UTC instant. Must be strictly earlier than valid_until. | |
| constraints | No | Optional further constraints, each with id, type, path, operator, value, and on_failure of deny or require_approval. At least one constraint must exist in total, counting those a spending limit generates. | |
| valid_until | Yes | RFC 3339 UTC instant. The mandate authorises nothing at or after it. | |
| evidence_refs | No | Optional identity, role, or authorisation evidence supporting the issue. | |
| approval_rules | No | Optional. Each rule carries id, a when predicate of path, operator, and value, an approver of organization_id and role, and expires_after_seconds. A matching act is held until an approval from that approver binds it. | |
| spending_limit | No | Optional. Becomes an amount ceiling and a currency constraint. A ceiling with no currency would be satisfied by that number of any currency, so both are written. | |
| status_endpoint | Yes | HTTPS URL where this mandate's current status is published. HTTPS only: cached status is the only channel a revocation reaches a relying party through. | |
| parent_mandate_id | No | The mandate this one is delegated from, or null for a root mandate. | |
| represented_organization_id | Yes | The organisation the subject represents in its acts, prefixed org_. |