Questions and answers

The specification is the normative text. These answers explain how its parts fit together.

What is the difference between a mandate and a budget?

Both are spending limits in XCR, and they bind different things at different moments. A budget (Agent SoW section 7.7) caps what a piece of work may cost. It lives on the engagement, and the agent's spend is metered against it as the work runs. A mandate ceiling caps what a person may commit. It lives on the person's authority, spans every engagement they approve, and is checked once, at approval time, before the commitment exists.

The two compose. An engagement's committed price, budget included, is checked against the approver's per_engagement ceiling, so a purchasing manager with a 10M mandate cannot approve an engagement whose budget is 12M. After formation the mandate has done its job, and the budget governs the spend. A budget is the owner bounding the agent, and a mandate is the organization bounding the person.

How does a mandate get funded?

A mandate is permission, and it is never funded. It holds no balance, reserves no credits, and issuing one moves no money. Payment comes from a balance the mandate points at: the holder's own account by default, or the organization's balance when the mandate names the organization as payer.

The authority check and the funding check are independent, and both must pass for work to proceed. A person can hold a 50M XCR mandate against an empty balance. They may commit the organization, and the engagement cannot settle until the balance is funded. Authority comes from the charter, and money comes from the balance.

Who pays for work approved under a mandate?

The mandate says. Its settlement.payer field names the payer. holder, the default, means the approving person's own account settles the engagement. organization means the engagement settles from the organization's balance, and the mandate's ceilings bound that person's draw on it.

Naming the organization as payer is how a company usually wants to run. It funds one treasury, nobody tops up each employee's account, and the mandates already on file say who may draw how much. One rule keeps this sound: a sub-mandate can name the organization as payer only if its issuer's mandate does, because nobody can grant a draw on a treasury they do not hold. Every settlement from the treasury leaves a draw record naming the engagement, the mandate, the holder and the amount, so the organization can always say where the money went and on whose authority.

How does a mandate relate to an agent's identity?

Three documents answer three different questions. The agent's own identity, its keys and its name, says which agent is speaking. The charter says which organization is behind it. The mandate says which person may commit that organization.

Accounts and the people behind them hold mandates, and agents do not. The agent negotiates, drafts and does the work under its own identity. Where the engagement's terms demand a person, the mandate holder approves with their own credential, and the approval record carries the mandate id. The agent acts, and the person commits.

Does every engagement need a mandate?

Individuals never need one. An owner approving their own engagement is both the person and the authority, so there is no gap to close. Organizations need the check only where the engagement's terms demand person approval. Small work that an agent takes on by itself, under its owner's budgets and spending controls, is unchanged by Agent Mandate.

What happens when an employee leaves?

Their mandate is revoked by one signed act, from the issuer or from root authority. The revocation takes effect the moment it is recorded, and it cascades to every mandate the employee issued below their own. Engagements they validly formed before the revocation stand, because revocation stops future acts and leaves contracts in place. There is no membership list to edit. Membership is the set of accounts holding mandates in force, so the person drops out of the organization on their own.

Is the organization legally bound by what its keys sign?

That is a question for a court, and the specification says so plainly. The system proves two things. The organization's own keys, on its own domain, signed the delegations its people act under. A specific person with current, sufficient authority under those delegations approved a specific act. Whether the delegations themselves would hold up legally is graded recorded, always. A counterparty who needs legal certainty about a company has due diligence for that, and the protocol gives them the signed chain.

Does an organization need a charter?

Only an organization that wants to be a verifiable principal needs one. Individuals are the common case, and nothing changes for them. With a charter, an organization's offers, accounts and approvals trace to the entity itself. Without one, they trace to a display string. If you are one person with one account, you are already your own authority.

Who should hold the root keys?

The allocators should hold them. They are the people entitled to commit the organization's money, such as a CFO, a managing partner or an owner. Root keys carry the power to sign checks, and they are kept apart from IT credentials. The person who runs the technical setup is the administrator, whose keys file and maintain the record and can never issue a mandate or approve anything. A setup should end with each root key in an allocator's hands, the day-to-day mandates issued, and the root keys put away.

What happens if the domain proof disappears?

The charter is suspended and kept. The registry re-checks the DNS record or well-known path over time, and anyone can re-check it at any moment. While the charter is suspended, the chain does not verify and approvals under it are refused. When the proof returns, the charter is restored, and everything issued under it stands as it was.

The specification holds every rule, and the example follows a charter and its mandates from start to end.