mandāre · Latin — to entrust, to command
The accountability layer for AI agents.
For what agents can do, Mandare removes the walls; for what they can’t reliably do, it caps the blast radius and records everything.
Every agent gets a verified identity, a spending limit its owner signs once, and a tamper-evident record of everything it did — enforced by the infrastructure the agent must pass through, never by trusting the agent.
# mandate signed ONCE: €5/call · €20/day · €100 total
# releasing a runaway loop — it will NOT stop itself…
call # 1 200 OK ~€0.28 spent so far
call # 10 200 OK ~€2.78
call # 40 200 OK ~€11.11
call # 70 200 OK ~€19.45
call # 72 403 DENIED — THE LOOP DIES HERE
code: PER_DAY_EXCEEDED
reason: settled €19.72 + estimate €0.28 > cap €20.00
the refusal itself is ledger entry 92938e3617eb03c8…
$ mandare verify --db ledger.db --spend
chain: VALID — every entry hash-linked and door-signed
counters: CONSISTENT — equal to a replay of the ledger
# the human signed once; the mandate did the saying-no- Apr 2026Machine traffic passes human traffic on the web
- Sept 2026Cloudflare default-blocks unsigned agents
- End 2026~45 billion non-human identities in operation
- 2026–27EU AI Act record-keeping obligations land
Agents got the keys. Nobody built the bank.
Companies now run fleets of AI agents that spend money, hold credentials, and act on their own — with none of the controls a bank would demand of any employee who touches money. The damage report, so far:
Figures from 2026 public reporting and vendor data; the full source list ships with the Mandare docs.
Three pieces. One discipline.
The machinery any bank runs for humans who touch money — identity, limits, audit — rebuilt as infrastructure for agents. The agent is never trusted; the doors it passes through are.
Who is this agent —
and who answers for it?
A cryptographic identity for every agent, bound to a verified human or company owner. The agent proves it’s really itself on every action, so a stolen credential is dead paper — and one command revokes everything the agent can touch.
passport did:key:z6Mkjwq2vDhHfhn2Mncyp… owner-bound · revocable
What is it allowed
to do?
The owner signs authority once — budgets, scopes, approval thresholds — and the agent works freely inside that boundary. One signature replaces forty prompts. Enforced at the doors, it holds even if the agent is hijacked.
mandate mnd_5450f0fbd6e7 €5/tx · €20/day · ask me above €0.25 signed once
What actually
happened?
An append-only, hash-chained flight recorder — written by the infrastructure, never by the agent, so it can’t be faked or erased. Log-before-act. The evidence file a finance team, an auditor, or an insurer can finally trust.
#143 2026-07-21T15:56:48Z DENIED refused 0.277803 EUR ← reservation refused by policy
This is not a slide deck.
The core is built. Every claim below is enforced by an automated test that runs on every code change — and each demonstration is captured on video.
-
S2 · PASS
A runaway loop dies at €20. 71 calls in 0.1 seconds — call #72 is refused, and the refusal itself is a ledger entry.
-
S3 · PASS
A stolen credential is dead paper. Forged proof rejected, replayed request rejected, and one kill command halts the agent mid-run.
-
S4 · PASS
One mandate, zero interruptions. Six task steps run with no prompts; only the one big decision pauses for a one-tap human approval.
-
S5 · PASS
The card declines at the network. One €20 mandate governs LLM spend and a real payment card together — the over-cap purchase is declined, on the ledger.
Every demo above is live and CI-enforced today. Next on the bench: S6 — off-machine witnessing.
Proofs, not data.
Mandare is local-first. The record of what your agents did lives on your machine — Mandare never sees it. We receive only tiny, content-free cryptographic fingerprints that let anyone later prove the record wasn’t tampered with. An oversight layer that cannot surveil you is rare — and it’s the point.
What your ledger holds — on your machine
What Mandare sees
77014fc7fd8b70f0c785abb2e37179225f7de8b22f99187495770cad6a881a66 a fingerprint — enough to prove integrity, nothing to read, leak, or subpoena
Nothing to leak We can’t lose, sell, or be forced to hand over what we never hold. Your agents’ activity is not our asset — its integrity is.
Not a bank Mandare never holds the money and never custodies funds — no banking license, no float, no counterparty risk hiding in the fine print.
No invented standards Built on the open standards the payment networks and the web are already adopting — Mandare fits into the world instead of fighting it.
built on · HTTP Message Signatures (RFC 9421) · W3C Verifiable Credentials 2.0 · IETF Token Status List · Web Bot Auth
Open the rails. Sell the assurance.
The core is open source and free — that’s how infrastructure becomes the default. The business is the assurance layer on top: the exact tier that carries every comparable open-source company.
Open, forever
Apache-2.0 spec & SDKs · AGPLv3 self-host core- The mandate format, attestation profile, and ledger spec
- SDKs, MCP server, and the embeddable policy engine
- Verification of any ledger or attestation — free, for anyone, always
- Full self-hosting: your agents, your machine, your record
Paid: the assurance
Hosted · verified · certified · insured- Hosted control plane for teams and fleets
- Verified-owner attestation — a real person stands behind each agent
- Certification that services are safe for agents to transact with
- Enterprise compliance pack: insurance-grade & AI-Act evidence exports
The moat isn’t the code — anyone can copy code. It’s the authority and the network: the trusted issuer of agent identity and the keeper of the track record, the way a credit bureau’s value is its file, not its software.
About the founder
“Identity checks, spending limits, ledgers, audit — I spent a decade in banking building exactly this machinery for humans. I also run a 33-agent fleet every day, so I feel the missing controls personally. Mandare ports the discipline of banking into the agent economy.”
— Founder, Mandare · 10+ years in banking, 5 in investment banking · MSc Finance & Accounting
Be first through the door.
Get the open-source launch, the demo drop, and early access to the hosted control plane. No spam — a handful of emails that matter.
This page makes zero external requests — no analytics, no trackers, no fonts phoned home. Your address is recorded to the waitlist and used for nothing else.