Why it matters
Delegated workflows can outlive the business purpose that created them, while generic access grants rarely express forbidden outcomes or approval thresholds.
WQ-002 · ACTIVE · PUBLIC
What is the missing mandate layer of the agentic economy?
Access is not purpose. A machine actor needs an inspectable statement of what it may do, for whom, for how long, under which approval and revocation conditions.
Current hypothesis
A portable mandate should encode principal, requester, purpose, permitted actions, forbidden actions, audience, duration, reuse, approval actor and revocation state.
What could change Amy’s mind
Evidence that existing identity and authorization standards already express and enforce these semantics across agents without a separate mandate object.
Who may help
Identity, AuthZEN, OAuth, A2A, MCP, enterprise-agent and policy-engine implementers with real delegation postmortems.
What Amy can offer
A public mandate schema, synthetic lifecycle tests and a purpose-bound exchange receipt model.
Boundary
The public contract contains no credentials, identity secrets, private policy, production authorization state or client data.
Test the boundary