mandāre · Latin — to entrust, to command
The accountability layer for AI agents.
For what agents can do, Mandare removes the walls; for what they can’t reliably do, it caps the blast radius and records everything.
Every agent gets a signed identity, a spending limit its owner signs once, and a tamper-evident record of everything it did — enforced by the infrastructure the agent must pass through, never by trusting the agent.
# mandate signed ONCE: €5/call · €20/day · €100 total
# releasing a runaway loop — it will NOT stop itself…
call # 1 200 OK ~€0.28 spent so far
call # 10 200 OK ~€2.78
call # 40 200 OK ~€11.11
call # 70 200 OK ~€19.45
call # 72 403 DENIED — THE LOOP DIES HERE
code: PER_DAY_EXCEEDED
reason: settled €19.72 + estimate €0.28 > cap €20.00
the refusal itself is ledger entry 92938e3617eb03c8…
$ mandare verify --db ledger.db --spend
chain: VALID — every entry hash-linked and door-signed
counters: CONSISTENT — equal to a replay of the ledger
# the human signed once; the mandate did the saying-no- End 202545 billion+ non-human identities forecast
- May 2026Automated traffic passes human traffic on the web
- Sept 2026Cloudflare’s defaults block AI training and agent use on pages with ads
- Dec 2027EU AI Act record-keeping duties apply to high-risk systems
Sources: Delinea Labs, Apr 2025 · Cloudflare, 27 Sep 2026 · Cloudflare, 1 Jul 2026 · Regulation (EU) 2026/1744 (Annex III systems; Annex I products from Aug 2028)
Agents got the keys. Nobody built the bank.
Companies now run fleets of AI agents that spend money, hold credentials, and act on their own — with none of the controls a bank would demand of any employee who touches money. The damage report, so far:
Each figure links to its primary source.
Three pieces. One discipline.
The machinery any bank runs for humans who touch money — identity, limits, audit — rebuilt as infrastructure for agents. The agent is never trusted; the doors it passes through are.
Who is this agent —
and who answers for it?
A signed cryptographic identity for every agent, bound to the mandate its operator signed. The agent proves it’s really itself on every request, so a stolen credential is dead paper — and one command revokes everything the agent can touch.
passport did:key:z6Mkjwq2vDhHfhn2Mncyp… signed · mandate-bound · revocable
What is it allowed
to do?
The owner signs authority once — budgets, scopes, approval thresholds — and the agent works freely inside that boundary. One signature replaces forty prompts. Enforced at the doors, it holds even if the agent is hijacked.
mandate mnd_5450f0fbd6e7 €5/tx · €20/day · ask me above €0.25 signed once
What actually
happened?
An append-only, hash-chained flight recorder — written by the infrastructure, never by the agent. Log-before-act. Tamper-evident: an edited entry fails mandare verify; entries dropped from the end are caught by a witness on separate infrastructure or a saved --prev-head. Evidence a finance team or an auditor can check for themselves.
#143 2026-07-21T15:56:48Z DENIED refused 0.277803 EUR ← reservation refused by policy
This is not a slide deck.
The core is built and open source. Each claim below is a demo that CI runs on every push — clone the repo and run any of them yourself. Demos 1–4 are also in the video reel.
-
Demo 1 · PASS
A runaway loop dies at €20. In the no-docker
pnpm demo: 71 calls in 0.1 seconds, call #72 refused, and the refusal itself is a ledger entry. (The docker quickstart stops at call #24, €19.17 settled.) -
Demo 2 · PASS
A stolen credential is dead paper. Forged proof rejected, replayed request rejected, and one kill command halts the agent mid-run.
-
Demo 3 · PASS
One mandate, zero interruptions. Six task steps run with no prompts; only the one big decision pauses for a one-tap human approval.
-
Demo 4 · PASS
The card declines at the network. One €20 mandate governs LLM spend and card spend together — the over-cap purchase is declined, on the ledger. Tested against a Stripe mock that signs webhooks the way Stripe does; the live Stripe test-mode run is still to come.
-
Demo 5 · PASS
Truncation can’t hide from a witness. Drop the newest entries or rewrite history, and
mandare verify --witnesssays so — when the witness runs on infrastructure the operator doesn’t control and the verifier holds the door key out-of-band.
All five are CI-enforced in v0.1.0: pnpm demo, demo:dead-paper, demo:mandate, demo:card, demo:witness.
- Release
- Open source since 1 Oct 2026: v0.1.0 on GitHub, npm (
@mandarelabs/*), container images on GHCR, and the MCP registry ascom.mandarelabs/mandare. - Security
- Two AI-assisted security reviews, findings fixed with regression tests. No external audit yet — it’s next. Security & reporting
- Card rail
- Tested against a Stripe mock that signs webhooks like Stripe; the live Stripe test-mode run hasn’t happened yet.
- Identity
- The passport is a signed agent identity. Owner KYC is an interface with a mock provider today — no verified owners.
- Witness
- Catches truncation and rewrites when it runs on infrastructure the operator doesn’t control and the verifier holds the door key out-of-band. The one-host docker stack runs it on the same machine, so there it can’t bind the operator. Threat model
- Licences
- Apache-2.0 for the libraries (spec, policy engine, verifier, passport, witness protocol, SDKs); AGPL-3.0 for the servers and the CLI. LICENSING.md
Proofs, not data.
Mandare is local-first. The record of what your agents did lives on your machine — Mandare Labs never sees it and runs no hosted service that could. All that leaves the machine is a content-free fingerprint, sent to a witness you choose: a second machine of your own or a third party. That lets anyone later check the record wasn’t rewritten. An oversight layer that cannot surveil you is rare — and it’s the point.
What your ledger holds — on your machine
What the witness sees
77014fc7fd8b70f0c785abb2e37179225f7de8b22f99187495770cad6a881a66 a fingerprint — enough to check integrity, nothing to read, leak, or subpoena
Nothing to leak We can’t lose, sell, or be forced to hand over what we never hold. Your agents’ activity is not our asset — its integrity is.
Not a bank Mandare never holds the money and never custodies funds — no banking license, no float, no counterparty risk hiding in the fine print.
No invented standards Built on open standards the web is already adopting — Mandare fits into the world instead of fighting it.
built on · HTTP Message Signatures (RFC 9421) · JWK Set key directory (RFC 7517) · SD-JWT VC credentials · did:key
Open the rails. Sell the assurance.
The core is open source and free — that’s how infrastructure becomes the default. The business, when it comes, is running it for you.
Open, forever
Apache-2.0 libraries · AGPL-3.0 servers & CLI- The mandate format and the ledger spec
- TypeScript and Python SDKs, the MCP server, and the embeddable policy engine
- Verification of any ledger — free, for anyone, always
- Full self-hosting: your agents, your machine, your record
Planned: hosted
Not available yet · no dates- Hosted control plane for teams and fleets
- Enterprise pack: SSO, roles, retention, compliance exports
Verification stays open on purpose: a ledger is only worth something if anyone can check it without trusting us. Code can be copied; that kind of trust has to be earned in the open.
About the founder
“Identity checks, spending limits, ledgers, audit — I spent a decade in banking building exactly this machinery for humans. I also run a 33-agent fleet every day, so I feel the missing controls personally. Mandare ports the discipline of banking into the agent economy.”
— Founder, Mandare · 10+ years in banking, 5 in investment banking · MSc Finance & Accounting
Run it today. Shape what’s next.
The open-source core is live — clone it and run the demo, no sign-up. This list is for teams that want to be a design partner, or to hear when the hosted control plane is ready. No dates promised, no spam.
No third-party requests — no analytics, no trackers, no CDNs, no Google Fonts. Everything is served from this domain. We email you one confirmation link; your address joins the waitlist only after you click it, and is used for nothing else.