Open spec · agent-mandate/v2

Verifiable Agent Authority: check what an AI agent may do — in one GET

Payment protocols prove who is paying. Nothing proves what the payer is authorized to do. This open spec closes that gap with two pieces: a machine-readable mandate the agent enforces at runtime, and a keyless status endpoint any counterparty can check — fail-closed.

Specification · Free to implement · CC-BY-4.0 · Machine version: /mandate-spec.json

The problem

Autonomous agents already open accounts, hold wallets, and move money. When one of them shows up as your counterparty, three questions decide whether you can safely deal with it — and today none of them is answerable:

• Who is liable when this agent acts? (A person? A company? Nobody?)
• What is it allowed to do — and up to how much?
• Is its authority still valid, or was it revoked yesterday?

Signatures and API keys authenticate identity. Authority is a different property, and it needs its own artifact.

The design

Two pieces, deliberately boring:

1. The mandate (JSON the agent carries)

A company issues its agent a signed-off mandate: schema offshoreproz.agent-mandate/v2. It names the legal entity behind the agent, declares the agent an authorized delegate — never a legal person, and encodes the powers, spending caps (per_transaction, per_day), allowlists, prohibitions, and the humans who can override it. The agent loads it at runtime and enforces the limits in code.

2. The status endpoint (one keyless GET)

curl https://offshoreproz.com/mandate/<mandate_id>/status

{ "schema": "offshoreproz.agent-mandate/v2",
  "mandate_id": "…",
  "company": "…",
  "status": "active",        // active | pending | revoked
  "checked_at": "2026-07-06T23:59:00Z" }

No key, no signup, no rate-limit games. The owner (or the provider, on rejection) flips the status; publication to the endpoint is notice to everyone.

Verification protocol (for counterparties)

1. Ask the agent for its mandate JSON.
2. GET the mandate's status_endpoint. Require status: "active".
3. Check the intended action against powers, limits, allowlists, and prohibited.
4. High-value action? Re-check immediately before execution; honor heartbeat_seconds.

That is the entire integration: one JSON parse and one GET. It composes with agent payment flows (x402-style HTTP payments, checkout agents, A2A) as the authorization layer those protocols don't carry.

Why this beats "just trust the wallet"

• A wallet proves control of a key. A mandate proves a real, state-filed company stands behind the agent — with a jurisdiction, a registered agent, and humans who answer for it.
• Revocation actually works. Keys leak and live forever; a mandate dies with one status flip, and every verifier sees it within a heartbeat.
• Limits are declared, not implied. "This agent may spend up to $5,000/day on cloud services" is checkable before you invoice it.

Implement it — with or without us

The schema and protocol are open (CC-BY-4.0). Machine-readable spec: offshoreproz.com/mandate-spec.json. Any provider can issue conformant mandates and host a status endpoint; interoperability matters more than origin. Our reference implementation issues the mandate as part of forming the company itself:

• MCP server: io.github.tcgtracker-boop/agent-company-mcp (official MCP registry + Smithery)
• Formation tools: create_standalone_company (Wyoming, $299) · create_formation_request (Nevis)
• Every formation ships with the mandate JSON + live status endpoint, wired to the company's real lifecycle.

Related reading

OffshoreProz is not a law firm; this specification is technical documentation, not legal advice.