Overview

MANDATE issues each of an organization’s AI agents an ENSv2 subname that is non-transferable, self-expiring, and instantly revocable. The subname’s resolver records are the agent’s mandate — its budget, its allowlist, its expiry. The agent can read its own leash but is cryptographically incapable of lengthening it.

That mandate is compiled into a Privy policy off-chain and anchored on Arc on-chain, so an agent’s spending is checked twice, from one source of truth. Revoke the ENS role and the agent’s next payment dies mid-flight.

The problem

Giving an AI agent a wallet is easy. Giving it a wallet whose authority is bounded, provable to a counterparty, and revocable in one transaction is not. Off-chain policy engines (Privy’s included) are excellent at the stateless half of that problem — per-transaction caps, recipient allowlists — but they are private to one application, cap out well below the scale a real agent economy needs, and Privy’s own documentation admits their stateful rolling budgets update after a request signs, not before. See /docs/privy for the specifics.

The primitive

A mandate is an ENS subname whose properties are emergent from which roles are withheld, not features bolted on:

• No transfer-admin role → the name is soulbound to the agent it was issued to.
• No renew role → the name expires on schedule, and the agent cannot extend it.
• The parent retains the unregister role → the org can always kill it.
• Per-key resolver permissions → the agent can write its own agent.status and agent.heartbeat, and nothing under mandate.*.

A sub-agent can delegate a strictly narrower slice of its own mandate to a sub-sub-agent — enforced by a monotonic-narrowing check in the registrar contract, not by convention. See /docs/ens.

How the three planes fit

Authority lives on Sepolia (ENSv2). Enforcement is an off-chain service that watches Sepolia and propagates — never originates — permission into a Privy policy and a signed Arc anchor. Money moves on Arc, checked against that anchor on every spend. Full diagram at /docs/architecture.