06 · Delegated authority

Alice’s Agent: Authority by Mandate

Alice and Bob share a Counter Agreement. Alice’s Agent is visible from the beginning but cannot act. Alice creates a separate Mandate, Bob activates it, and the Agent gains only the exact increment operation Alice granted.

Executable Playground example3 participants2 documentsMandate lifecycle

The authority graph

Being present is not permission.

The Agent can inspect the Agreement but has no direct owner channel. Its authority comes from a separate Operation Mandate whose actor, target document, operation, exact request, guarantor, and lifecycle state must all match at action time.

The feeder fails closed.

Without an eligible active Mandate, no delegated Timeline Entry is appended. A near-match does not become authority by interpretation.

Open Authority by Mandate Mandates concept

Alice + Bob Counter Agreement
           ▲ exact target and operation
           │
Alice ── creates Operation Mandate
Bob ───── activates as guarantor
           │
           ▼
Alice’s Agent may request increment(+3)

Pending    → blocked
Active     → exact +3 allowed
Mismatch   → blocked
Terminated → blocked

Run it

Watch authority change through time.

The Guide deliberately includes denied attempts before, during, and after the grant so the boundary is visible rather than merely asserted.

Alice increments directly.The Agreement owner already has a direct channel, so no Mandate is consulted.

Try the Agent before a Mandate exists.The request is withheld; no delegated Timeline Entry is appended.

Alice creates the Mandate, then try while Pending.The grant is a separate document and remains unusable until Bob confirms it.

Bob activates it.The guarantor confirms the bounded grant and creates an Active mandate revision.

Try a mismatched request, then exact +3.Amount 2 is withheld. The Agent’s exact amount-3 call succeeds on Alice’s behalf and cites the selected authority epoch.

Continue direct work, terminate, and try again.A later Alice action proceeds normally; future delegated use fails closed immediately after termination.

What this teaches

Authority is exact, attributed, and time-dependent.

The evidence answers not only “was this operation allowed?” but “which living authority revision allowed this actor to make this exact request at that moment?”

GrantorAlice defines the delegated power.

GuarantorBob confirms and activates the Mandate.

ActorAlice’s Agent remains the attributed caller.

LifecyclePending, Active, and Terminated revisions change eligibility.

ScopeTarget, operation, and request must match exactly.

Next: make delivery safe under uncertainty.

Safe Retry shows how atomic admission and durable idempotency prevent one action from taking effect twice.

Next example All seven examples