Mandato: Protocol-Level Enforcement of Digitally Signed Mandates on AI Agent Actions with Cryptographically Chained Audit Trails

• URL: http://arxiv.org/abs/2608.14074v1
• Date: Fri, 14 Aug 2026 08:33:43 GMT
• Title: Mandato: Protocol-Level Enforcement of Digitally Signed Mandates on AI Agent Actions with Cryptographically Chained Audit Trails
• Abstract summary: We present Mandato, a governance proxy that enforces digitally signed mandates on agent actions at the protocol level.<n>A mandate is a machine-readable, cryptographically signed authorization artifact specifying which tools an agent may invoke.<n>We describe the implementation status of the reference system and a quantitative evaluation plan covering enforcement overhead, audit completeness, and tamper-evidence verification cost.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: AI agents increasingly act on external systems through standardized tool-calling protocols such as the Model Context Protocol (MCP), yet no infrastructure layer constrains their actions to what a principal has verifiably authorized: authorization logic lives in application code, is neither signed nor independently auditable, and the resulting logs lack evidentiary value. We present Mandato, a governance proxy that enforces digitally signed mandates on agent actions at the protocol level. A mandate is a machine-readable, cryptographically signed authorization artifact specifying which tools an agent may invoke, under which parameter constraints and contextual conditions, for how long, and on whose behalf; the proxy evaluates every tool call against the applicable mandate chain, blocks non-conforming calls in line, and records every decision -- permit, deny, and the evidence for each -- in an append-only, hash-chained audit log designed for evidentiary use and periodically anchored via qualified timestamps. The mandate is deliberately modeled on the civil-law institution of delegation of authority, making the artifact legible to lawyers and auditors, not only to engineers. We give the mandate model and its decision semantics, the reference architecture as an MCP-transparent proxy with separated decision and enforcement points, and a mapping of the mechanism onto EU AI Act Articles 12 and 14, GDPR accountability, NIS2, and eIDAS 2, including a roadmap to qualified attestation through Qualified Trust Service Providers (QTSPs). We describe the implementation status of the reference system and a quantitative evaluation plan covering enforcement overhead, audit completeness, and tamper-evidence verification cost.

Related papers

• Binding Biometrics with AI Agent Identifiers for Delegation of Authority [35.87507447481885]
  We present a framework called BIND to securely bind biometric data of the human user to the AI agent identity (ID) and authority scope (task-specific constraints) at the time of agent authorization.<n>This token/identifier can be presented by the AI agent to an Identity Auditor, who simultaneously performs biometric authentication and recovers the agent ID and scope.<n>We also provide a practical implementation of the proposed BIND framework based on face features extracted using standard deep neural network models.
  arXiv  Detail & Related papers  (2026-08-04T23:58:27Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation [0.0]
  This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation.<n>We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA)
  arXiv  Detail & Related papers  (2026-07-23T13:55:02Z)
• Behavioral Governance for Autonomous AI Agents: The AgentBound Framework [2.4469484645516832]
  We present AgentBound, a runtime governance framework that provides verifiable behavioral oversight for autonomous AI agents.<n>AgentBound evaluates each proposed action using three independent authorities: delegated authorization, owner-signed behavioral constitutions, and site action contracts.<n>AgentBound generates cryptographically verifiable governance receipts that bind every action to the exact delegation, policy, and semantic artifacts governing the decision.
  arXiv  Detail & Related papers  (2026-06-29T23:12:06Z)
• Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure [2.124730017640531]
  Sovereign Assurance Boundary is a certificate-bound runtime admission layer for autonomous execution authority.<n>We detail the airlock-broker architecture, formalize its admission and revocation invariants, and report preliminary feasibility measurements from a Go prototype.
  arXiv  Detail & Related papers  (2026-06-10T03:49:57Z)
• Digital Identity for Agentic Systems: Toward a Portable Authorization Standard for Autonomous Agents [0.0]
  This paper analyzes representative enterprise use cases in insurance claims processing and supply chain integrity.<n>It proposes a portable authorization model for autonomous agents based on issuer-authored authorization payloads.
  arXiv  Detail & Related papers  (2026-05-12T04:04:34Z)
• Agent Control Protocol: Admission Control for Agent Actions [0.4929694290403903]
  Agent Control Protocol (ACP) is a formal specification for admission control governance of autonomous agents in B2B institutional environments.<n>ACP defines cryptographic identity, capability-based authorization, deterministic risk evaluation, chained delegation, and cryptographically-chained auditing.<n>ACP operates on top of RBAC and Zero Trust, addressing what neither model solves.
  arXiv  Detail & Related papers  (2026-03-19T12:28:28Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• Zero-Trust Runtime Verification for Agentic Payment Protocols: Mitigating Replay and Context-Binding Failures in AP2 [0.0]
  We present a security analysis of the AP2 mandate lifecycle and identify enforcement gaps that arise during runtime in agent-based payment systems.<n>We propose a zero-trust runtime verification framework that enforces explicit context binding and consume-once mandate semantics.<n>We show that context-aware binding and consume-once enforcement address distinct and complementary attack classes, and that both are required to prevent replay and context-redirect attacks.
  arXiv  Detail & Related papers  (2026-02-06T03:22:11Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• Towards Trusted Service Monitoring: Verifiable Service Level Agreements [37.76528129929801]
  Service Level Agreement (SLA) monitoring in service-oriented environments suffers from inherent trust conflicts when providers self-report metrics.<n>We introduce a framework for generating verifiable SLA violation claims through trusted hardware monitors and zero-knowledge proofs.
  arXiv  Detail & Related papers  (2025-10-15T10:02:29Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)
• CryptoFormalEval: Integrating LLMs and Formal Verification for Automated Cryptographic Protocol Vulnerability Detection [41.94295877935867]
  We introduce a benchmark to assess the ability of Large Language Models to autonomously identify vulnerabilities in new cryptographic protocols. We created a dataset of novel, flawed, communication protocols and designed a method to automatically verify the vulnerabilities found by the AI agents.
  arXiv  Detail & Related papers  (2024-11-20T14:16:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.