Mandates

A mandate is the authorization root for machine payments. It defines who approved the authority, which agent may spend, which resources are allowed, which payment methods and chains are permitted, and which limits apply.

Common policy fields include:

• agent: the agent identity and environment.
• paymentMethods: supported methods such as x402, mpp, or evmStablecoin.
• paymentPath: offchain or onchain.
• allowedSellers and allowedResources: seller/resource constraints.
• maxPerPayment, windowBudget, and totalBudget: spend controls.
• expiresAt: hard expiration.
• metadataPolicy: redaction rules for prompts, messages, context, and sensitive headers.

Mandates can also reference portable authorization evidence. Future OpenPermit APIs should use optional authorizationEvidence[] entries for VI/AP2 mandates, Web Bot Auth verification, provider-issued agent credentials, seller commitments, and voucher proofs. These artifacts strengthen audit and dispute readiness without replacing the canonical OpenPermit mandate policy.

The SDK exposes mandate helpers from @openpermit/sdk/primitives for deterministic IDs and summaries.

import { getMandateId, summarizeMandate } from '@openpermit/sdk/primitives';

const mandateId = getMandateId(policy);
const summary = summarizeMandate(mandate);

See Authorization Evidence for how external proof artifacts should attach to mandates and receipts.