Mandates
Living authority documents for bounded delegation to agents, providers, intermediaries, and document-mediated processes.
What it answers#
Mandates answer: why may this actor exercise authority held by another actor for this exact action?
They turn delegation into inspectable typed state rather than a hidden permission row or bearer token.
Base roles and lifecycle#
The base model has an authority holder, authorized actor, and guarantor, each represented by a Timeline Channel. The processed lifecycle distinguishes Pending, Authority Confirmed, Active, and Terminated states, with failure and early termination paths.
Lifecycle timestamps come from causal provider-backed entries rather than caller-supplied payload values.
Operation Mandate#
An Operation Mandate can bind:
- one logical target document;
- one authority channel;
- one operation;
- one authorized actor and represented holder;
- static request shape;
- BEX validation;
- target-state preconditions;
- confirmation, activation, and termination rules.
Document Responder Mandate#
A responder Mandate can authorize a service to answer covered Requests from sessions of one logical document. The service independently selects and verifies an active matching Mandate; the Request does not dictate the authority artifact.
Provider-mediated authority#
A source document may ask an intermediary such as MyOS Admin to call an operation in another document. The intermediary verifies source-side authority and writes a new target entry. The target feeder independently verifies the target-side Mandate at the new entry time.
Scope integrity#
Protected mandate types can reject generalization, monitor protected paths, and terminate when target or validation scope changes. The architecture should make attempted authority expansion end the authority rather than silently broaden it.
Current implementation evidence#
The supplied Playground includes a real Operation Mandate flow: Pending, guarantor confirmation, Active, one valid delegated operation, an out-of-scope request withheld by validation, termination, and later delegated calls blocked.