Skip to main content
A mandate is an immutable, end-user-approved statement of what your platform may do within fixed policy and time bounds. Your backend creates the mandate for an authenticated end user. The end user then approves that exact mandate with a passkey. If the authority changes, create and approve a new mandate. Never mutate an approved one.

​
Required bounds

Every mandate includes:
  • subject_reference: your stable, opaque end-user identifier—not an email address or name
  • policy: a versioned action and deterministic constraints
  • approval_deadline: no more than 24 hours after creation
  • valid_from and valid_until: an interval of at most 30 days
  • An optional external_reference for your own correlation

​
States

CONSUMED, REVOKED, and EXPIRED are terminal.

​
Single-use semantics

A v1 mandate may evaluate many candidates, but it authorizes at most one successful execution.
  • At most one authorization can hold a reservation at a time.
  • DENY and INDETERMINATE do not reserve the mandate.
  • Cancelling or expiring a reservation makes an eligible active mandate available again.
  • Committing an authorization permanently consumes the mandate.
Revoking a mandate never deletes evidence. If an external execution capability can still act, disable it before revocation or cancellation.

Define a policy

Learn the exact operators, payment rules, and fail-closed behavior in policy v1.