Mandat – Authorization, delegation and audit for AI agent actions

Open-source developer Saidvosidov released Mandat, an authorization, delegation, and audit framework designed specifically for Model Context Protocol tool calls executed by autonomous artificial intelligence systems, according to github.com's report. The Apache-2.0 licensed project introduces granular runtime evaluation for agentic actions, establishing cryptographic provenance across complex delegation trees while recording every operation in a tamper-evident ledger.

This report examines Mandat's architecture, security scanners, client integrations, and policy enforcement mechanics across TypeScript and Python environments. The technical analysis is written for platform engineers, security architects, and enterprise developers deploying autonomous agents across production infrastructure.

01Policy checks and delegation chains

Mandat evaluates incoming agent requests against deterministic permission rules before any downstream tool executes. The engine inspects functional parameters directly against defined thresholds, allowing low-risk actions like refunds equal to or below fifty euros while flagging transactions between fifty and five hundred euros for human approval. Requests exceeding five hundred euros receive an immediate denial.

Agent identity is established through ephemeral, task-specific security tokens rather than static operational keys. These single-task credentials preserve the entire authorization line from the initiating human user down through primary agents and intermediate sub-agents. The design ensures accountability persists across multi-tier autonomous delegation flows without granting open-ended system permissions.

Every completed or rejected action generates an individual audit record designed for forensic ingestion. These entries are structured for immediate export into enterprise security information and event management platforms. Mandat also compiles the structured logs into summarized auditor reports to satisfy compliance verification and incident investigation requirements.

02Package distribution and runtime requirements

The project distributes components across standard package ecosystems without introducing third-party runtime dependencies. The core command-line interface installs through npm on Node versions twenty or higher, bundling the management control plane, configuration scanner, and an agent bridge into a single binary. Package builds are generated inside continuous integration workflows with verified provenance and required maintainer sign-off.

Server-side enforcement libraries target both major programming environments used across Model Context Protocol development. TypeScript implementations install the native Mandat library through npm without execution scripts, while Python environments require Python 3.10 or higher to run the official protocol package. Both libraries hook directly into server initialization routines to evaluate requests locally.

Engineers can test the execution loop without installing persistent binaries by cloning the repository and executing a demonstration script on Node 23.6 or higher. The zero-dependency distribution model eliminates standard supply-chain attack vectors such as malicious install scripts or compromised nested dependencies. This approach ensures runtime predictability across host environments.

03Client configuration and vulnerability scanner

Mandat incorporates automated vulnerability scanners targeting both protocol servers and local developer configurations. Operators execute network scans against server endpoints to identify insecure authentication implementations, cross-origin resource sharing defects, flawed OAuth discovery endpoints, and proof-of-concept tool poisoning exposures. A hosted web-based version of the scanner operates at scan.themandat.xyz to simplify remote diagnostics.

Local environment scanning evaluates client configuration files across desktop developer tooling including Cursor, VS Code, and Claude Desktop. The scanner inspects local configurations to identify unpinned software packages, plaintext credentials, and arbitrary shell command invocations. Identifying these insecure settings prevents malicious instructions from escalating privileges through developer environments.

The scanning toolchain packages into automated continuous integration pipelines via dedicated GitHub Actions or standalone Fly.io deployments. Teams can enforce strict tool-pinning configurations across development clusters before merging agent definitions. This early inspection layer mitigates common configuration oversights before services connect to runtime control planes.

04Autonomous support agent demo workflow

The project includes an end-to-end support workflow demonstration simulating agent operations on behalf of a human user named Maria. The scripted sequence demonstrates policy evaluation under shifting operating conditions, permitting a twenty-euro refund instantly while pausing a one-hundred-twenty-euro refund for human review. A nine-hundred-euro refund request is rejected outright by the policy engine.

The demonstration also highlights defense-in-depth protections when an agent encounters untrusted external content. After reading an incoming customer email that contains an embedded prompt injection attack, the agent attempts to exfiltrate system data to an outside server address. Mandat intercepts and blocks the external network transmission.

Delegation controls restrict subordinate processes, demonstrated when a spawned sub-agent receives a reduced mandate capped at thirty-euro refunds. An administrative kill switch locks the agent out of the system in under a second when malicious behavior is observed. Subsequent attempts to tamper with past audit ledger entries trigger immediate cryptographic detection.

05Enterprise control plane and guard integration

Developers protect custom TypeScript servers by wrapping the McpServer instance with a guard object configured with the control plane address and service key. Python servers follow an identical pattern, securing tools using the protect function against the base server object. These wrapper hooks intercept incoming tool arguments to enforce policies before internal handler execution.

The external control plane provides central policy administration, webhook listeners, and Slack approval routing for operations requiring human intervention. Enterprise identity providers including Auth0, Okta, Microsoft Entra ID, and Keycloak connect directly to authenticate human approvers. Teams can author decision rules in Mandat's policy language, testing parameters in shadow mode before live deployment.

External agents connect through a local bridge utility, enabling tools like Claude Code, Codex, Cursor, and Claude Desktop to interact with protected resources. The platform combines this bridging mechanism with SIEM data streams and global kill switches, allowing security teams to manage distributed autonomous workloads safely.