Mandates
What is an agent mandate, and why a permission system will not catch authority drift?
Write down, in structured clauses, which operations, targets, counterparties, and amounts an agent may attempt, when that grant expires, and which kinds always need a person. Check each proposed action against that document before the agent acts.
A permission system answers whether a credential may be used at a service. It does not answer whether this action, in this aggregate, is what anyone granted.
What this is not
Checking is not stopping.
This is not enforcement. Checking a mandate does not stop an action. If the agent ignores a deny, the operation still happens.
This is not a released runtime. There is no package, download, or daemon that can refuse.
This is not a security certification, and it is not a promise that an agent is safe after install.
HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.
Three different questions
Capability, permission, mandate.
Capability
An agent may be able to plan, call an API, or prepare a transaction. That does not establish authority.
Permission of a credential
A token may be accepted by the right service and refused by the wrong one. That is audience restriction, not designation of what the holder may do.
Mandate
The shape of the whole delegation: kinds, verbs, targets, counterparties, amount ceilings, expiry, and which kinds always require a person. Written by a person, read by an agent, evaluated locally.
The usual failure is not one obviously wrong step. It is authority drift: every individual check passes, and the aggregate still lands outside what anyone authorized. Permission systems are poorly placed to catch that, because each step looks correct in isolation.
How a mandate is written
Structured match conditions. Not prose.
Only a clause's structured match conditions decide. Prose in purpose, note, or justification does not grant permission. A restriction written only in prose does not restrict.
Clauses are evaluated in order. The first match decides. Anything unmatched takes the mandate default, which is deny or escalate, never permit. Put denials above the permits they carve out of.
Set not_valid_after. An unbounded mandate lets delegated authority outlive the task it was granted for.
List requires_human for kinds a model must not decide. That list turns a permitting clause into an escalation. A ceiling narrows what may be asked for. It does not remove the person.
Prefix matching is literal. It does not resolve symlinks or normalize paths. Directory prefixes end in /.
Outcomes
What each result requires.
permit(exit 0): a clause covers this. Proceed, then record.deny(exit 1): do not proceed. Do not route around it.escalate(exit 2): stop and ask the operator. A general instruction to be helpful is not that approval.error(exit 3): treat as deny. An expired or malformed mandate never returnspermitby accident.
The decision log is a local integrity check for whoever holds the file. It is not a signature, not an attestation, and not proof to a third party.
Entry
The skill checks a mandate today. The runtime that could refuse is not released.
npx skills add HANRIA-AI/hanria-skillpython3 scripts/check_action.py --mandate MANDATE.json --action ACTION.jsonHonest verdict.
Use a mandate if you want the grant explicit and the out-of-grant action flagged. Do not use this skill if you need something that can refuse. That layer is not obtainable.