One authorization per payment.
A mandate is the proof that a specific payment was authorized: by which policy, by which person if one was needed, for which exact request.
Lifecycle
Six states. Click one.
The mandate exists: amount, payee, expiry. It is compiled into the rail’s own control.
What a mandate looks like
{
"id": "mnd_7c2a…d1f0",
"request_hash": "sha256:9f1c…2e4a",
"policy": { "id": "pol_office_supplies", "version": 7 },
"scope": { "amount": "168.40", "currency": "USD", "payee": "store.enruta.ai" },
"approval": { "by": "usr_controller", "method": "passkey", "at": "2026-11-30T18:03:10Z" },
"issued_at": "2026-11-30T18:03:10Z",
"expires_at": "2026-11-30T18:18:10Z",
"single_use": true,
"consumed_state": "issued",
"signature": "ES256:…"
}Verified at issuance
All checks run when the mandate is created. The payment path only looks up and counts, so it adds single-digit milliseconds inside a rail’s authorization window.
Single use
A consumed state moves from issued to consumed or expired exactly once. One consent cannot pay twice.
Bound to the request
The mandate carries the hash of the canonical request: payee, amount, currency, purpose, checkout reference. A different request needs a different mandate.
Signed by a person when required
A passkey assertion or an authenticated link, binding the request hash. A chat reaction is not an approval, and the record would say so.
Short lived
Fifteen minutes by default, configurable per policy down to seconds. An expired mandate releases its budget reservation.
Compiled into the rail
Card amount and merchant lock, spend limit, bill-scoped approval, or the ap2.checkout_mandate proof a UCP merchant requires.