What Is a Mandate Record?

AI agents are executing consequential actions at scale. They are filing legal documents, executing contracts, approving transactions, and scanning codebases for vulnerabilities. In most cases, there is no formal record of what the agent was authorized to do.

There are logs. Logs capture timestamps, API calls, inputs, outputs, and errors. But a log is not an authorization record. A log tells you what happened. An authorization record tells you what was supposed to happen, by whom it was sanctioned, and within what limits.

This distinction matters because the humans who deploy AI agents are now legally responsible for what those agents do, yet they cannot demonstrate responsible oversight without a record of what they authorized.

The oldest problem in the law

The need for authorization records is not new. Agency law, one of the oldest bodies of law in existence, has always required a defined scope of authority. A principal is liable for what their agent does within the scope of that authority. The scope has to be documented somewhere.

In traditional agency relationships, it is documented in employment contracts, professional mandates, letters of instruction, and powers of attorney. These documents exist because without them, nobody, not the principal, not the agent, not a court, not a regulator, can answer the question that arises when something goes wrong: was this action authorized?

The Restatement (Third) of Agency defines express authority as authority explicitly stated in a written or oral agreement. Powers of attorney, written legal documents granting specific authority to act on another's behalf, remain the gold standard for documenting who authorized whom to do what. Corporate board resolutions, employment contracts, and professional mandates all serve the same function: they create a pre-action record that defines what the agent may and may not do before the first action is taken.

AI agents need the same thing.

What a mandate record contains

A mandate record is the AI agent equivalent of a power of attorney. It is a structured, signed document that defines the scope of an agent's authority before execution. It answers six questions:

Who authorized this? The human sponsor or principal who issued the authority. In traditional agency, this is the employer, the client, or the grantor of a power of attorney. For AI agents, it is the deployer, the organization or individual that put the agent into the world with a defined task.

What is the agent permitted to do? The specific actions the agent may take. These are enumerated, not implied. A contract review agent might be authorized to read contracts, flag clauses, and draft summaries. It is not authorized to sign contracts, initiate payments, or share confidential information with third parties.

What is the agent prohibited from doing? Explicit exclusions. Not "anything not permitted is prohibited." The prohibitions are stated affirmatively. This matters because AI agents can generate novel actions that no one anticipated. Prohibitions provide a fallback when the permitted-action list is incomplete.

Under what regulatory framework? The laws and regulations that apply to the agent's actions. A healthcare agent operating in the US is subject to HIPAA. A financial agent in the EU is subject to MiFID II. A legal agent in the UK is subject to SRA guidance. The mandate record specifies which frameworks apply and what they require.

For how long? The temporal scope of the authorization. Start time, expiration conditions, time-of-day restrictions, and whether the authorization is task-specific or ongoing. An agent authorized to complete a single contract review expires when the review is done. An agent authorized to monitor compliance runs continuously, but the mandate defines when it must be re-evaluated.

Can it delegate? Whether the agent can instruct other agents, and under what constraints. Multi-agent pipelines are already common. The Google A2A protocol, the Model Context Protocol, and frameworks like LangGraph and AutoGen are designed to make agent-to-agent delegation seamless. What they do not address is what happens to the authorization record when it crosses an organizational boundary. The mandate record must define sub-delegation rules, limits, and escalation requirements.

Why logs are not enough

Technical logs capture what the agent did. Mandate records capture what the agent was supposed to do. Without both, you cannot answer the question courts and regulators will ask: did the agent stay within its bounds?

Consider a concrete example. An AI agent at a law firm instructs a research agent at a data provider to retrieve case law on a specific topic. The research agent returns results. The law firm's agent incorporates them into a brief. The brief contains fabricated citations.

The logs will show: the research agent was called, it returned results, the results were incorporated. What the logs will not show: who authorized the research agent to act on the law firm's behalf, what scope the research agent was operating within, whether the research agent was permitted to access the specific documents it accessed, and whether the research agent exceeded its authorization when it generated the fabricated citations.

Without a mandate record, the law firm cannot demonstrate that it defined and enforced appropriate boundaries. The data provider cannot demonstrate that its agent operated within the scope authorized by the law firm. The court cannot determine who is responsible.

What the regulations require

The regulatory landscape is converging on mandate documentation, even if it does not always use the term.

The EU AI Act's Article 12 requires high-risk AI systems to "technically allow for the automatic recording of events ('logs') over the lifetime of the system." Logs must be retained for at least six months. The logging standard requires traceability, the ability for a third party to reconstruct what happened. The practical requirements include timestamps, session and user IDs, model identifiers and versions, inputs and outputs, and downstream actions. "Technically allow" rules out a logging policy that depends on operators remembering to enable it.

Colorado's AI Act requires deployers of high-risk AI systems to complete impact assessments before deployment, at least annually, and within 90 days of any substantial modification. The assessment must document the system's purpose, intended use cases, data inputs and outputs, performance metrics, and transparency measures. Deployers must retain these assessments for at least three years.

Singapore's Model AI Governance Framework for Agentic AI, the world's first national framework designed specifically for agentic systems, establishes four governance dimensions: assess and bound risks upfront, ensure meaningful human accountability, implement technical controls, and enable end-user responsibility. Each dimension implicitly requires mandate documentation. You cannot assess risks without defining scope. You cannot hold humans accountable without documenting who authorized what.

NIST's February 2026 concept paper on agent identity and authorization identifies four fundamental gaps: identification, authentication, authorization, and auditability. The paper asks: how are permissions scoped? How is activity logged and audited? How are agents revoked? These are mandate record questions.

The World Economic Forum's May 2026 "AI Agents in Action" report introduces the Agent Capability and Authorization Profile, a deployment-level authorization record for agent systems. The report states: "Organizations are increasingly able to describe what an agent is capable of, but often lack a consistent way to determine what it is authorized to do within a specific workflow."

The gap is already visible

Only 14.4% of organizations report their AI agents go live with full security approval, according to the Gravitee State of AI Agent Security 2026 Report. The vast majority of agents launch without complete oversight.

Without mandate records, the consequences are already materializing. Researchers have documented 1,397 cases of courts finding parties relied on hallucinated AI content. In 720 US incidents, attorneys were sanctioned or disciplined for filing AI-hallucinated content. The highest recorded fine: $110,000.

In Mobley v. Workday, the court held Workday liable as an "agent" even without a direct employment relationship, rejecting the defense that Workday was "just a software vendor." In OLG Hamm, a German court held a business fully liable for false statements by its AI chatbot, ruling that "careful selection and preparation of training data does not relieve liability." In the Amsterdam District Court, X Corp. was held directly responsible for harmful outputs generated by Grok, with the court stating: "The entity that designs and controls the system remains the 'designed responsible party.'"

In each case, the court asked the same question: who controlled this system, and can they prove they exercised that control responsibly? Without a mandate record, the answer is no.

What Truss does

Truss records mandate boundaries before execution and creates a verifiable chain of custody for every agent action. A mandate record in Truss defines who authorized the agent, what the agent may and may not do, under which regulatory framework, for how long, and whether it can delegate.

When an action is taken, Truss creates a signed action record that links the action to the mandate. The record is cryptographically sealed: tamper-evident, verifiable, and admissible. When a court, regulator, or counterparty asks whether an action was authorized, the answer is a record, not an argument.

This is not a new concept. It is the oldest concept in the law, applied to the newest class of actors in the economy. HTTPS made online commerce trustworthy. Financial audits made corporate finance trustworthy. Mandate records will make AI agents trustworthy.

The infrastructure will be built. The only question is whether we build it before or after the first collapse significant enough to make its absence undeniable.