MANDATE Credential Broker

Returns this self-describing tool manifest.

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Creates an active human-granted mandate for an agent and records it to the hash-chained ledger.

{
  "type": "object",
  "required": [
    "organization_id",
    "agent_id",
    "grantor_principal_id",
    "budget_currency",
    "budget_total",
    "per_action_limit",
    "expires_at",
    "scopes"
  ]
}

Creates a child mandate only when it is a no-escalation subset of the parent mandate.

{
  "type": "object",
  "required": [
    "parent_mandate_id",
    "delegator_agent_id",
    "delegate_agent_id",
    "budget_total",
    "per_action_limit",
    "starts_at",
    "expires_at",
    "scopes"
  ]
}

Submits an action through the Gateway and canonical Policy Engine; returns ALLOW, DENY, or REQUIRE_APPROVAL with ledger proof.

{
  "type": "object",
  "required": [
    "acting_agent_id",
    "action_type",
    "amount_minor",
    "counterparty"
  ]
}

Records a proof payload hash and appends proof evidence to the hash-chained ledger.

{
  "type": "object",
  "required": [
    "organization_id",
    "subject_type",
    "subject_id",
    "proof_type",
    "payload"
  ]
}

Revokes a mandate subtree and records the revocation to the hash-chained ledger.

{
  "type": "object",
  "required": [
    "revoked_by_principal_id",
    "reason"
  ]
}

Registers an opaque vault handle/reference only; plaintext secret fields are rejected and never ledgered.

{
  "type": "object",
  "properties": {
    "vault_handle": {
      "type": "string",
      "description": "Opaque vault reference such as vault://provider/path; never a plaintext secret."
    },
    "metadata": {
      "type": "object"
    }
  },
  "required": [
    "organization_id",
    "registered_by_agent_id",
    "label",
    "credential_type",
    "vault_handle",
    "allowed_action_type"
  ]
}

Asks the canonical Policy Engine for an ALLOW decision before issuing a short-lived HMAC-sealed grant bound to credential, mandate, agent, scope, and expiry.

{
  "type": "object",
  "required": [
    "credential_id",
    "acting_agent_id",
    "mandate_id",
    "action"
  ]
}

Redeems a sealed grant for the bound acting agent and executes the bound action through the Gateway and Policy Engine; does not expose plaintext secrets.

{
  "type": "object",
  "required": [
    "grant_token",
    "acting_agent_id"
  ]
}

Revokes a broker grant by id and records the revocation to the ledger.

{
  "type": "object",
  "required": [
    "revoked_by_agent_id",
    "reason"
  ]
}

Validates a grant token seal, reports active/revoked/expired state, and records introspection to the ledger.

{
  "type": "object",
  "required": [
    "grant_token"
  ]
}