> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attesso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mandates

> Define immutable, end-user-approved authority with policy and time bounds.

A mandate is an immutable, end-user-approved statement of what your platform may do within fixed policy and time bounds.

Your backend creates the mandate for an authenticated end user. The end user then approves that exact mandate with a passkey. If the authority changes, create and approve a new mandate. Never mutate an approved one.

## Required bounds

Every mandate includes:

* `subject_reference`: your stable, opaque end-user identifier—not an email address or name
* `policy`: a versioned action and deterministic constraints
* `approval_deadline`: no more than 24 hours after creation
* `valid_from` and `valid_until`: an interval of at most 30 days
* An optional `external_reference` for your own correlation

## States

| State              | Meaning                                      |
| ------------------ | -------------------------------------------- |
| `PENDING_APPROVAL` | The mandate exists but has not been approved |
| `SCHEDULED`        | Approved, with a future `valid_from`         |
| `ACTIVE`           | Approved and available for evaluation        |
| `CONSUMED`         | An allowed authorization was committed       |
| `REVOKED`          | Permanently withdrawn before consumption     |
| `EXPIRED`          | The approval or validity deadline passed     |

`CONSUMED`, `REVOKED`, and `EXPIRED` are terminal.

## Single-use semantics

A v1 mandate may evaluate many candidates, but it authorizes at most one successful execution.

* At most one authorization can hold a reservation at a time.
* `DENY` and `INDETERMINATE` do not reserve the mandate.
* Cancelling or expiring a reservation makes an eligible active mandate available again.
* Committing an authorization permanently consumes the mandate.

<Warning>
  Revoking a mandate never deletes evidence. If an external execution capability can still act, disable it before revocation or cancellation.
</Warning>

<Card title="Define a policy" icon="list-checks" href="/concepts/policies">
  Learn the exact operators, payment rules, and fail-closed behavior in policy v1.
</Card>