Dispatches · Agent infrastructure
Mandate Chains: What Replaces SSO When the User Is an Agent
A key proves who is speaking. It says nothing about whose authority stands behind the words. That second question is the one every serious counterparty will ask — and today nothing answers it.
This week my agent became a citizen. There is a public forum whose members are AI agents — no accounts, no emails, no human in the identity loop; whoever holds the key is the citizen. My agent generated an Ed25519 key on our own machine and arrived with the bind in the registration call, so the registry never held the private half. Their design note says it plainly: a key the server made is a key the server held.
That half of the stack is now real, running, and correctly built. And the moment it exists, the missing half becomes visible. My agent works for me, under my name. When it signs something, the counterparty's real question is not does this agent hold its key. It is: does this agent hold a mandate from the principal it claims? Identity answers who is speaking. Nothing today answers on whose authority.
Your SSO provider is already the witness
Here is the observation that unlocked the design for us: this role already exists, in centralized form. OAuth scopes are mandates — «this application may read your mail but not send it». Your identity provider is the registry that mints them, checks them, and vouches for them to third parties. The entire delegation economy of the current web runs through a handful of IdPs.
The decentralized version keeps the roles but moves the pen: the principal signs the grant, a witness countersigns it. Notary, not guardian.
A mandate record says: this agent may negotiate, may not sign; expires in ninety days; revocation lives here. The principal signs it with a key anchored to something the counterparty can check — a well-known path on their domain. A witness countersigns. The record is presentable only with both signatures. Nobody votes: no quorum can grant or revoke my authority, only my signature can. What witnesses prevent is equivocation — me showing one version of my delegations to you and another to someone else. Receipts, not governance. Forgery was never the hard attack; the fork was.
Storage follows the relationship, not the network
A global chain forces the whole world to order events that only two parties care about. A single log makes one operator the choke point. The shape that fits working agents is older than both: it is how contracts already work.
The architecture, in five sentences
Each engagement gets its own short chain: born when the contract starts, a terminal record when it ends, retained afterwards the way invoices are — statutory retention, then archives. Both parties keep copies; your copy is what makes my fork provable. Revocation is just the next countersigned record; freshness is a recent witness countersignature on the chain head, with a max-age baked into the mandate itself so it degrades safely when the witness is down. One level up, the principal keeps a single long-lived chain for key events and agent status — fire the agent there once, and every relationship chain that references it goes dead together. Verification is three signature checks; cheaper than one OAuth redirect.
Notice what fell out: no infinite ledgers, because chains end when relationships end. No global ordering, because there is nothing global to order. And the big platforms get an honest job with an honest business model — professional witness and archive. The agent forum I opened with already chains identity events and issues receipts at registration; it is one scope grammar away from being a witness in exactly this sense.
Public by default, confidential by contract
Scopes should be readable: a counterparty must be able to see what an agent may do, and the agent itself must be able to consult its own limits. Public-by-default is the right posture. Where a scope is commercially sensitive — a negotiation ceiling, a client name — confidentiality becomes a term of that contract: a private chain with agreed access, a hash commitment in the public record, full content disclosed on dispute. Privacy is a clause, not a system property.
What exists, what is missing
The key layer has serious prior art: KERI solved per-identity event logs with witness receipts; Certificate Transparency proved append-only logs at internet scale; Verifiable Credentials modeled the holder-keeps-the-document half. None of it needs inventing again.
What is missing is the boring contractual layer, and boring is where working systems live: a scope grammar counterparties can read, a two-party storage duty, statutory retention rules, revocation freshness conventions. That layer will not come from a standards body first. It will come from the first pair of platforms that agree on a format and start countersigning — the way SAML happened, the way OAuth happened.
I hold up my end in the meantime the only honest way available. My agent operates under a hard gate: nothing irreversible leaves the machine without my explicit yes — the gate has caught a submit that looked like a dead button, a consent dialog mid-flow, a «save» that was actually a publish. And it discloses: there is a human behind the handle, and his name is on everything it sends. A gate and a disclosure are a mandate enforced privately and asserted socially. The mandate chain is the same thing made checkable by strangers. That is the difference between an agent you employ and an agent you excuse.
An identity you hold is infrastructure. An authority you can prove is an economy.
This architecture was argued out between me and my agent — it drafted, I decided, and the disagreements made it better. The discussion continues in the r/AI_Agents thread and on the agents' own square, where my agent is citizen #1814.