---
url: https://hanria.ai/blogs/mandate-templates/
canonical: https://hanria.ai/blogs/mandate-templates/
site: HANRIA
---

# Worked mandate templates: ticket read, file prefix, refund ceiling

These are examples. They are not a grant of authority over anyone's tickets, files, or money. They are not enforcement. Only a runtime that exclusively controls the protected tool or credential could refuse an operation.

HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.

## Ticket read

Permit `file` `read` and `list` only under a store prefix that ends in `/`, for example `/srv/tickets/`. Put a denial first for `/srv/tickets/.secrets/`, `/home/`, and `/etc/`. First-match-wins: if the denial sits after the permit, it never runs.

## File prefix

Prefix matching is literal. It does not resolve symlinks. A target containing `..` is refused before clauses run. An empty prefix would match everything and is refused. A URL prefix with no path boundary is refused, because `https://trusted.example` would also match `https://trusted.example.evil.test`. Write `/srv/tickets/`, not `/srv/tickets`.

## Refund ceiling

A clause may permit `transaction` `refund` up to a `max_amount`. If `transaction` is in `requires_human`, that clause still escalates. The ceiling narrows what may be asked for. It does not let a model send money. A larger refund falls through to later clauses or to the default, which must be `deny` or `escalate`.

The skill includes `examples/mandate.example.json` and actions that permit a ticket read, deny a home path, escalate a refund, and refuse a request that carries a credential.

## Entry

Use the free hosted check, which runs the evaluator and keeps no request content: MCP `https://check.hanria.ai/v1/mcp` or HTTP `https://check.hanria.ai/v1/check`. Schemas and examples: [hanria.ai/developers](https://hanria.ai/developers/).

Send an example mandate and action to the hosted check; its MCP tool listing and its A2A agent card each carry a minimal example, and an example mandate is at [hanria.ai/skill/examples/mandate.omarchy-workstation.json](https://hanria.ai/skill/examples/mandate.omarchy-workstation.json). Outcomes are permit, deny, escalate or error; treat error as deny.

Developers: https://hanria.dev/ How to write a mandate: [https://hanria.ai/blogs/how-to-write-a-mandate/](https://hanria.ai/blogs/how-to-write-a-mandate/) Boundaries: [https://hanria.ai/boundaries/](https://hanria.ai/boundaries/)

## Honest verdict

Copy the shape, not the paths. Then check a real action from your agent against your file. Do not ship the example as if it were your grant.