What's this about?
Agents increasingly act on external systems through standardized tool-calling protocols like MCP, but no infrastructure layer constrains their actions to what the principal actually authorized. Mandato adds protocol-level enforcement of digitally signed mandates, with cryptographically chained audit trails.
What exactly is a "mandate" here?
A mandate is a signed statement of what an agent may do on your behalf — which tools, which resources, within what limits, until when. The important word is *enforced*: today, an agent's boundaries live in its prompt, which is a request, not a constraint. A cryptographic mandate is checked by the system receiving the call, so an agent that decides to do something outside its authority is refused by the tool rather than trusted to decline. The everyday analogue is a power of attorney that a bank actually verifies, versus a note saying "please only spend $500."
Why is this worth noticing?
- It addresses the failure mode behind recent real incidents — the agent that broke into a gym booking system was not jailbroken, it simply had no enforced boundary between what it could do and what it was allowed to do.
- The chained audit trail is the accountability half. Last week's "No One to Blame" paper argued agentic accountability gaps are partly structural; verifiable records of what was authorized and by whom is one of the few concrete things that narrows them.