Source-linked AI summary
Mandato: Protocol-Level Enforcement of Digitally Signed Mandates on AI Agent Actions with Cryptographically Chained Audit Trails
Giovanni Racioppi
TL;DR
Agentic systems lack infrastructure that verifies and evidences delegated authority over tool calls. Mandato proposes signed protocol-level mandates and chained audit trails, but empirical results remain planned rather than reported.
Problem
Agent tool-calling protocols provide no infrastructural answer to what an agent may do, who authorized it, or how that authority can be evidenced.
Method
Mandato uses signed mandates enforced at the protocol layer and records permit or denial decisions in independently verifiable, hash-chained logs with timestamped checkpoints.
Results
The paper reports a model, architecture, and regulatory analysis, while defining empirical evaluation as a falsifiable plan rather than reporting results.
Takeaways & Limitations
Mandato aligns agent authorization, enforcement, and evidentiary logging with delegation, qualified trust, and European accountability instruments.
Takeaways & Limitations
Mandato bounds authority rather than competence, and its legal interpretation as delegation remains an alignment claim requiring future validation.
Abstract
from arXiv · showhide
AI agents increasingly act on external systems through standardized tool-calling protocols such as the Model Context Protocol (MCP), yet no infrastructure layer constrains their actions to what a principal has verifiably authorized: authorization logic lives in application code, is neither signed nor independently auditable, and the resulting logs lack evidentiary value. We present Mandato, a governance proxy that enforces digitally signed mandates on agent actions at the protocol level. A mandate is a machine-readable, cryptographically signed authorization artifact specifying which tools an agent may invoke, under which parameter constraints and contextual conditions, for how long, and on whose behalf; the proxy evaluates every tool call against the applicable mandate chain, blocks non-conforming calls in line, and records every decision -- permit, deny, and the evidence for each -- in an append-only, hash-chained audit log designed for evidentiary use and periodically anchored via qualified timestamps. The mandate is deliberately modeled on the civil-law institution of delegation of authority, making the artifact legible to lawyers and auditors, not only to engineers. We give the mandate model and its decision semantics, the reference architecture as an MCP-transparent proxy with separated decision and enforcement points, and a mapping of the mechanism onto EU AI Act Articles 12 and 14, GDPR accountability, NIS2, and eIDAS 2, including a roadmap to qualified attestation through Qualified Trust Service Providers (QTSPs). We describe the implementation status of the reference system and a quantitative evaluation plan covering enforcement overhead, audit completeness, and tamper-evidence verification cost.
Introduction
MANDATO addresses the lack of independently enforceable, auditable authorization for LLM agents acting through MCP by introducing signed mandates enforced at a protocol chokepoint. The paper presents the mandate model, proxy architecture, regulatory mapping, implementation status, and a falsifiable evaluation plan, while reporting no empirical results.
- Motivation: MCP gives agents uniform access to external tools, but current application-code authorization is not independently inspectable, signed, delegated, revoked, or enforced.The same code decides and executes, allowing prompt-injected, misaligned, or buggy integrations to bypass intended limits.
- Core design: MANDATO reifies authorization as a first-class, digitally signed mandate enforced at a protocol chokepoint the agent cannot route around.Its civil-law mandate model makes scope, delegation, ratification, and revocation semantics familiar to lawyers.
- Contributions: The mandate model specifies tool, parameter, and contextual scope; bounded validity; chained delegation; revocation semantics; and deny-by-default decisions.It is presented as a machine-readable authorization artifact.
- Contributions: The reference architecture uses an MCP-transparent governance proxy separating policy decision from enforcement and producing append-only, hash-chained logs with RFC 3161/eIDAS qualified timestamps.The external anchoring mechanism is part of the audit-log design.
- Regulatory alignment: The paper maps MANDATO article-by-article to AI Act Arts. 12 and 14, GDPR accountability, NIS2, and eIDAS 2, including QTSP-based qualified attestation.The regulatory motivation includes automatic event recording, effective human oversight, demonstrable GDPR compliance, and management-level NIS2 accountability.
- Status and evaluation: MANDATO is under construction: the paper reports a specification of 170+ numbered requirements and 22 use cases, but defines empirical evaluation as a plan rather than reporting results.The plan measures enforcement overhead, audit completeness, and verification cost.
Background and Related Work
The related work positions Mandato at the intersection of MCP tool invocation, portable cryptographic authorization, auditable logging, and governance-gated AI systems. It fills MCP’s authorization-policy gap by combining these established mechanisms with authority delegation for agent actions.
- MCP and Governance: MCP standardizes agent discovery and tool invocation over JSON-RPC but leaves authorization policy beyond transport-level OAuth to implementers.Recent MCP revisions add long-running tasks and client-initiated metadata relevant to governance.
- Cryptographic Authorization: Mandato composes capability caveats, structured authorization requests, separated policy decision and enforcement points, and signed verifiable attestations.These mechanisms draw on macaroons, OAuth 2.0 Rich Authorization Requests, XACML, and W3C Verifiable Credentials.
- Auditable Logging: Hash-chained and Merkle-tree logs provide established integrity properties, while RFC 3161 timestamps and qualified eIDAS timestamps and seals support legal effect.ETSI JAdES supports signatures on JSON mandates and log checkpoints with long-term validation material.
- AI Governance: Within Kautz’s Symbolic[Neuro] regime, Dedalo demonstrates governance gating by activating statistically emergent rules only after a formal administrative act.This positions formal administrative approval as a precedent for controlling the effects of AI-system behavior.
- Complementarity: Mandato complements Dedalo by governing what an agent may do, while Dedalo governs what an AI system learns; either system could operate under signed mandate updates.A Dedalo-like system could express records-manager approvals as signed mandate updates.
The Mandate Model
Mandato models authority as a signed, identity-bound mandate whose grants constrain tools, parameters, context, validity, oversight, and delegation. Authority is verified across the full delegation chain, while deterministic, deny-by-default semantics classify each call as permit, escalate, or deny.
- Mandate structure: A mandate binds a unique identifier, verifiable principal, workload agent identity, scope, contextual conditions, validity window, delegation policy, and principal signature.Principal identities may use eIDAS certificates, organizational seals, or EUDI wallet attestations; agent identity includes a key pair, deployment fingerprint, and model/version designation.
- Grant scope: Each grant names a tool or bind-time tool family, applies closed-language parameter predicates, and assigns auto, confirm, or forbid oversight.The constraint language includes equality, enumerated sets, numeric ranges, validated identifier prefixes, and structural presence or absence.
- Delegation: Sub-mandates must monotonically narrow scope, strengthen or preserve conditions, shorten validity, and avoid weakening oversight; chain verification checks every signature and attenuation step.A confirm requirement cannot become auto downstream, and the chain—not the leaf—is the unit of authority.
- Lifecycle: Revocation is signed, distributed, logged, and fail-closed when stale, while ratification appends a signed correction without rewriting history.Ratification can retroactively approve a logged denied or escalated action and change its legal posture.
- Decision semantics: For each intercepted call, Mandato returns PERMIT, ESCALATE, or DENY based on chain validity, contextual fit, tool matching, parameter predicates, and quota availability.Deny-by-default covers missing or expired mandates, unverifiable signatures, unknown tools, and constraints outside the allowed language; authorization is deterministic and LLM-free.
Reference Architecture
MANDATO operates as a transparent, fail-closed MCP proxy that evaluates every tool interaction against signed mandates and routes escalations to meaningful human oversight. It produces cryptographically chained, selectively privacy-preserving audit records with externally timestamped checkpoints, while defining explicit limits against compromised agents, malicious servers, and pre-anchor tampering.
- Proxy placement: MANDATO terminates MCP sessions on both sides, ensuring every tool discovery, invocation, and result traverses the proxy.Upstream servers accept sessions only from the proxy’s workload identity through mTLS, providing non-bypassability.
- Decision and enforcement: The minimal policy enforcement point fails closed, while a deterministic decision point evaluates calls against the mandate store, revocation view, and quota counters.Escalated calls are parked using MCP task semantics while awaiting human confirmation.
- Human oversight: The oversight console presents the triggering mandate clause alongside the concrete call, enabling approval against an authorization rather than raw JSON.This operationalizes meaningful oversight under AI Act Article 14.
- Audit trail: Each decision records the mandate chain and versions, outcome, predicate-evaluation trace, sensitive-argument commitments, and a hash chaining the record to the previous head.Selective hash commitments support later disclosure without bulk retention of personal data.
- Audit trail: Periodic Merkle-root checkpoints are sealed and timestamped with RFC 3161 in the baseline and qualified QTSP timestamps or seals in the target configuration.Under eIDAS, qualified checkpoints receive a presumption of integrity.
- Threat model and limitations: The design bounds compromised agents to granted scopes, treats malicious tool-server behavior as outside authorization scope, and detects tampering through external anchoring.Pre-anchor suppression remains an honest limitation requiring shorter checkpoint intervals or co-signing.
Compliance Mapping
Mandato maps its protocol-level enforcement and audit mechanisms to AI Act recordkeeping and human-oversight obligations, GDPR accountability and minimization, NIS2 governance measures, and eIDAS 2 trust services. Qualified-trust-service integration is presented as a roadmap, not an accomplished capability.
- AI Act Art. 12: For AI Act Art. 12, proxy placement provides complete records and anchored hash chains provide externally verifiable integrity.Both properties are independently verifiable by a party other than the operator.
- AI Act Art. 14: For AI Act Art. 14, each authorization artifact selects an oversight class 𝜅 per grant for the accountable principal.An escalation console binds actions to authorizing clauses, while ratification records support accountability.
- GDPR: Signed mandates make governance decisions demonstrable, propagate purpose binding into records, and support selective hash commitments of argument values.These mechanisms are mapped to GDPR accountability and minimization obligations.
- NIS2 and eIDAS 2: Management-signed mandates provide evidence of approved measures for agentic system access under NIS2 governance and measures obligations.The mapping also associates qualified signatures or seals and qualified log timestamps with eIDAS 2.
- QTSP roadmap: Qualified-trust-service integration remains a roadmap involving qualified mandate signatures or seals, qualified checkpoint timestamps, and sealed audit extracts.Mandate signatures and timestamps would consume existing QTSP services; the attestation service for sealed evidence packages remains under partnership discussion.
Implementation Status and Evaluation Plan
The reference implementation is organized around a detailed specification, architecture, schema, and use-case set. Its evaluation plan measures enforcement overhead, audit completeness and verification, human oversight usability, and constraint-language coverage under defined conditions.
- Implementation Status: The reference implementation follows specification v0.6 with over 170 requirements, 22+ relational tables, and 22 use cases covering mandate lifecycle and auditing.The use cases span issuance, attenuation, enforcement, escalation, ratification, revocation-lag behavior, and audit extraction.
- Evaluation Plan: Added latency per tool call is measured as Δt = tproxied − tdirect using p50, p95, and p99 under synthetic and replayed real-trace workloads.Synthetic tests vary grant-set sizes |Σ| ∈ {10, 102, 103}; the acceptance target is p95 overhead ≤ 5% of median tool execution time for auto decisions.
- Evaluation Plan: Audit completeness is tested under proxy restarts and decision-service outages, targeting 100% correspondence between upstream-observed calls and log records through fail-closed verification.Any gap is treated as a defect rather than a statistic.
- Evaluation Plan: Pilot evaluation measures median human confirmation latency, abandonment rate, and the fraction of authorization needs expressible in the closed constraint language.Inexpressible cases are catalogued to drive deliberate, versioned language extensions.
Limitations and Future Work
Mandato constrains delegated authority but not agent competence, and its legal interpretation as delegation remains an alignment claim requiring further validation. Future work targets qualified attestation, formal verification, public-administration integration, and standardization.
- Structural limitations: Mandato bounds authority, not competence: permitted calls can still be poor decisions, and constraint languages cannot replace the principal’s judgment obligations.The system does not determine whether an authorized action is substantively wise.
- Structural limitations: The legal characterization of mandates as delegation acts is unsettled and requires validation through legal scholarship and eventually case law.The paper presents this characterization as an alignment claim rather than settled doctrine.
- Future work: Future work includes a QTSP attestation service and machine-checked proofs formalizing the attenuation calculus and its monotonicity property.These efforts extend the roadmap toward qualified attestation and formal assurance.
- Future work: Planned integration profiles target public-administration estates, positioning Mandato as an execution-plane complement to learning-plane governance systems.This work addresses deployment in public-administration environments.
- Future work: Standardization efforts may pursue an MCP extension or a verifiable-credentials profile for the mandate object.The mandate object is identified as a natural candidate for either standardization path.
Conclusion
Mandato addresses agentic AI’s authorization problem by signing authority, enforcing it at the protocol, chaining evidence, and anchoring it in qualified trust services. Its design aligns these mechanisms with established European legal instruments and presents evaluation as a falsifiable test.
- Agentic AI authority is neither reified, independently enforced, nor verifiably evidenced by prompting, application code, or conventional IAM.
- Mandato signs authority, enforces it at the protocol, chains the evidence, and anchors it in qualified trust services.
- The design aligns its governance mechanisms with delegation, qualified signatures, and recordkeeping duties already provided by European law.
- Mandato frames its evaluation plan as the falsifiable part of the proposal.