Mandates

The problem, precisely

Alice's shop has an operation on her channel:

contracts:
  ownerChannel:
    type: Timeline Channel
    # bound to Alice

  setPromotionalPrice:
    type: Sequential Workflow Operation
    channel: ownerChannel
    request:
      amountMinor:
        type: Integer

Alice acts by putting an Operation Request on her Timeline. Her pricing agent has its own Timeline and may even sit in the document as a participant — but it can do nothing: its entries can never enter ownerChannel. Good — that's honest attribution. But then how does the agent ever set a price?

A Mandate bridges roles without faking identity

An Operation Mandate is a document with three participants — the authority holder (Alice), the authorized actor (the agent), and a guarantor who confirms the relationship is real — and one narrow grant:

type: Operation Mandate
target:
  channel: ownerChannel
  operation: setPromotionalPrice
validation:
  request:
    amountMinor:
      schema:
        minimum: 10000
        maximum: 30000

Not "the agent may act as Alice." Rather: this actor may invoke this one operation, through this channel, on Alice's behalf, while the Mandate is active, for amounts between 100 and 300 PLN. A capability a human can read and a machine can verify.

Now the agent acts — on its own Timeline, saying exactly what it is doing:

actor:
  type: Verified Agent Actor
  agentId: alice-pricing-agent
onBehalfOf:
  type: Mandate Authority
  actor:
    type: Principal Actor
    accountId: alice
  mandate:
    blueId: 7Hs9W...
message:
  type: Operation Request
  channel: ownerChannel
  operation: setPromotionalPrice
  request:
    amountMinor: 17500

Who acted: the agent. Whose authority: Alice's. Under what: an exact, inspectable document. Nothing pretends Alice clicked a button.

The feeder proves two things about time

Before that request reaches the operation, the feeder must establish two separate temporal facts:

1. The entry's place in the document's time. Ordinary completeness across the target document's channels — nothing earlier is missing anywhere; this entry is safely next.
2. The Mandate's state at that exact moment. Here is the elegant part: the Mandate is itself a document, with its own Timelines — the guarantor's, Alice's, the agent's. So the feeder gathers completeness on the Mandate's channels up to the entry's timestamp T and resolves the Mandate's exact processed state at T. Active at T? Request within every constraint? No revocation anywhere before T? Only then is the entry eligible.

Glimpses are not proof. "I saw an activation entry" or "I haven't seen a termination" establishes nothing — a termination could exist unseen. The feeder resolves the actual processed Mandate state, exactly the way any document state is resolved: completeness, ordering, deterministic processing. Because authority is a document, verifying authority is just computing a document. There is no separate permission infrastructure to trust — and anyone auditing later can rerun both computations and get the same answer.

Unknown is never yes: missing evidence defers the action; resolved-negative refuses it. Request 175 PLN — applied. Request 450 PLN — refused, with a reason anyone can recompute.

Authority is temporal

A Mandate lives through a lifecycle:

Pending → Authority Confirmed → Active → Terminated

Confirmation and activation are deliberately separate facts: the guarantor confirming that the delegation is legitimate is not the same as the authority becoming usable. Usually activation follows confirmation immediately; but a Mandate can defer it — legitimate now, usable only when a condition occurs, such as an embedded engagement agreement becoming effective.

And validity is judged at the action's timestamp, not at audit time. An action at 10:30 under a Mandate active since 09:10 stands, even after an 11:00 termination. An action at 09:08 was never valid, no matter what activated at 09:10. Revocation has a place in history rather than being a cache-invalidation prayer — the past stays explainable, the future stays governable.

Far more than a permission bit

Because a Mandate is an ordinary document, everything on this page applies to it. A serious one embeds its own living machinery:

Payment Operation Mandate
├── customer consent process
├── account verification
├── daily spend counter
├── merchant category policy
└── emergency termination workflow

Each child has its own contracts and Timelines; the Mandate activates only when its embedded conditions hold, and can terminate itself when a spend counter trips or a risk monitor fires. Compare that with a scope string in an OAuth token.

And note what Mandates are not: agent-only. A human assistant rescheduling dinners, a legal firm answering reviews, a procurement service placing orders — same model, same lifecycle, same auditability. Agents made explicit delegation urgent; people and services needed it all along.