Proofs, not data.

Every activity-recording system faces the same question sooner or later: who watches the record? If your agents' complete history — every API call, every payment, every approval — sits on a vendor's servers, that vendor is now the most valuable target in your stack. It can be breached. It can be subpoenaed. It can quietly become a data business. Enterprises know this, which is why "send us your full agent telemetry" is a hard sell to exactly the buyers who need accountability most.

The record stays home

Mandare is local-first: the ledger — the append-only, hash-chained record of everything your agents did — lives on your machine. We never see its contents. What leaves your machine is a content-free cryptographic fingerprint, sent to a witness you choose — a second machine of your own or a third party: a hash that commits to the record's state without revealing a single byte of what's in it.

That fingerprint is not decoration. Because each entry is hash-linked to the previous one and signed by the infrastructure that wrote it — the door the agent passed through, never the agent itself — any later edit to an entry breaks the chain visibly, and mandare verify names the entry. Dropping the newest entries is subtler: the shorter file still verifies on its own. That's what the witness is for. Run on infrastructure you don't control, with the verifier holding the door key out-of-band, it makes truncation and rollback detectable too. The record's integrity becomes publicly checkable while its contents stay private.

What this buys you

Nothing to leak. We can't lose, sell, or be forced to hand over what we never hold. Your agents' activity is not our asset; its integrity is.

Nothing custodial. Mandare never holds the money either — no float, no banking license, no counterparty risk hiding in the fine print. Limits are enforced at the doors; funds never touch us.

Evidence that convinces skeptics. An auditor or a finance team doesn't have to trust your agent's self-report — agents demonstrably misreport their own actions — or trust us. They verify the chain themselves. Verification is free, for anyone, forever; the verifier is open source (Apache-2.0). You can see exactly what that verification looks like in a runaway loop dying at €20, where the refusal itself becomes a checkable ledger entry.

No invented standards

The cryptography here is deliberately boring: HTTP Message Signatures (RFC 9421) for signed requests, a JWK Set key directory for publishing door keys (modelled on the Web Bot Auth directory drafts; we make no claim that a Web Bot Auth verifier accepts a Mandare signature or directory), SD-JWT VC for credentials, did:key for identifiers. Mandare's job is to compose the standards the web is already adopting — and to fit into that world rather than fight it.

In an industry nervous about AI oversight, an oversight layer that cannot surveil you is rare. That's not a compromise we accepted. It's the design. The full picture — identity, mandates, and this ledger — lives on the Mandare homepage.