procedure

Grant and revoke an agent mandate

An agent prepares and proposes. A named human authorises money.

Authority for an agent is a data structure rather than a setting. A mandate is a revocable, versioned grant enumerating exactly which actions are allowed, in which currency, for how long, and up to what money ceiling. The stronger guarantee sits underneath it: eleven consequential operations have no MCP tool at all — approval resolution, mandate replacement and revocation, mission closure, supplier dossier verification and live-grant issuance among them — so they cannot be reached by an agent regardless of what a mandate says.
steps
6
roughly
Ten minutes
things needed first
2
before you start

What you need first

  • A workspace and the human permissions that gate consequential actions, which are issued from server-controlled roles
  • A mission for the agent to work inside
the procedure

6 steps

Every step carries the thing that goes wrong at it, in its own block. That is the part worth reading.

  1. step 01

    Create a mission

    A mission is a durable objective owned by your workspace. Everything the agent does happens inside one.

    what goes wrong here

    Agents cannot close their own missions. That is a human-only operation with no agent tool.

  2. step 02

    Grant a mandate with an explicit ceiling

    Enumerate the allowed actions, the currency, the validity window and the money ceiling. A mandate that does not name an action does not permit it.

    what goes wrong here

    Set the ceiling to what you are willing to lose rather than what you intend to spend. It is the backstop, not the budget.

  3. step 03

    Let the agent prepare and propose

    The agent works through ordered steps against the mandate, recording decisions and evidence as it goes. It can extract, compile, plan, draft creative and surface exceptions.

    what goes wrong here

    It cannot enable spend. Approval records evidence; enabling spend on a staged live line is a separately granted action.

  4. step 04

    Approve by exact digest

    High-consequence work requires a single-use approval bound to an exact action digest. If the request that arrives does not match the bytes a human approved, it fails closed.

    what goes wrong here

    An integration test proves an agent attempting to resolve its own approval receives a 403 requiring human approval. This is enforced at the API rather than advertised in tool metadata.

  5. step 05

    Resolve exceptions yourself

    An ambiguous supplier outcome raises an exception, halts the run, and waits for an explicit human resolution and resume. It is never retried automatically.

    what goes wrong here

    This is the failure this design exists to prevent: an agent that cannot read a supplier's response and tries again has just created a second campaign nobody knows about.

  6. step 06

    Revoke when the work is done

    Revoke the mandate rather than leaving it to expire. Revocation is a human-only signed action with no agent tool.

    what goes wrong here

    A secret-only credential rotation also advances the connection revision and revokes issued grants, which is worth knowing before you rotate a key mid-campaign.

what you end up with

An agent that can do useful work inside an explicit ceiling, and cannot reach any of the operations that commit money.

other procedures

What else you might need to do

45 minutes. Bring a real brief and we compile it live.

Talk it through

Questions

What can an agent do that a human cannot undo?

Nothing that commits money. Eleven consequential operations — approvals, provider-attempt resolution, mandate replacement and revocation, mission closure, workflow acknowledgement, asset-job resolution, dossier saving and verification, and issuing or revoking a live execution grant — are human-only signed REST actions with no agent tool at all. What an agent can do is prepare, propose, draft and surface, all of it recorded. The design intent is that an agent removes work rather than removing accountability.