AI agent mandate

Agent charter · Delegation contract

Definition

An AI agent mandate is the written document that sets what the agent may do and what it must refuse, with figures: its scope, its ceilings per action and per day, its conditions for escalation and the people who answer for it. It acts as the delegation contract between the organization and its agent.

What a mandate contains

  • The purpose served and the decisions covered, each with its autonomy level.
  • The ceilings: an amount per action and a cumulative amount per day. A ceiling nobody has signed is not a ceiling.
  • What the agent must refuse by design.
  • When it must seek confirmation before acting and when a person takes over.
  • The version of the model it was tested on, because changing it reopens what was signed.
  • The named signatories: the business, technical, compliance and DDAO functions.

A vague mandate authorizes everything

A scope worded in general terms allows whatever it does not explicitly exclude. "Serve the customer as well as possible" is an intention, and an agent will follow it all the way to refunding everyone. Telling signs of a mandate that has not been finished include the absence of any figure, or a list of permissions with no list of refusals.

Limiting consequences works better than listing gestures. As agents become more general, the list of possible actions can no longer be written down in full, whereas the outcome to be avoided can still be stated: no payment to a changed bank account without a call-back, whatever route leads there.

A sandbox does not replace a mandate

Containment limits what an agent can reach, while a mandate says what it has the right to decide. Both are worth having and they do different work. The card networks and commerce platforms have reached the same conclusion from another direction, offering bounded payment tokens with a spending ceiling, permitted merchant categories and revocable authorization in place of an ordinary card handed to the agent.

Frequently asked questions

Who signs an AI agent's mandate?

Those who carry the consequences: at minimum the business owner of the decision and the DDAO, and usually also technical and compliance functions.

How is a mandate different from a system prompt?

A system prompt is an instruction read by the agent, which it can lose or misinterpret. A mandate is a commitment signed by people, whose limits are also enforced outside the agent.

How often should a mandate be reviewed?

At each change of scope, model version or supplier, after each incident, and on a regular schedule. A mandate is never granted once and for all.

Where does your organization stand?

ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.

Take the ACF ScoreAI Act checkerACF Control

Related terms

Delegated authorityA power to decide that a person or organization entrusts to someone else, here an AI agent, while keeping responsibility and the right to take it back.AI agent decision authorityThe scope of decisions an AI agent is entitled to take by itself, set by the organization and bounded by limits written in advance.DDAO (Delegated Decision Agent Officer)The function created by ACF that answers for the decisions an organization delegates to AI agents, and that can refuse a deployment.AI agent authorization vs authorityAuthorization is what an agent can technically reach; authority is what it is entitled to decide. Governing an agent requires both, and they often diverge.

See all 25 terms in the glossary

Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .