{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.wm-ai-015","code":"wm-ai-015-agent-delegation-mandate","url":"https://ver.cy/models/wm-ai-015-agent-delegation-mandate/","name":"Agent Delegation Mandate","alternateNames":[],"kind":"world-model","status":"published","version":"0.1.0-review.20261021","language":"en","classifiers":{"family":"World Models","category":"Information and virtual systems","entryKind":"relationship","plane":"","domain":["INF.AI.MND"],"industry":["Cross-industry"],"navPath":"NAV.INF.AI.MND","tags":["agent","delegation","mandate","inf.ai.mnd"],"facets":{}},"whatItIs":"One identified delegation relationship and its mandate revisions. The root connects a principal, delegate and authorized work context; it records asserted terms and evidence without issuing credentials or deciding runtime access. Proposed, accepted, disputed, suspended and ended mandates remain distinguishable. This is a proposed format-neutral research model, not an executable authorization or legal instrument.","purpose":"Describe a versioned entrustment of bounded work to an identified agent on behalf of a principal, with authority evidence, limits, oversight and an effective interval.","scope":{"in":["Mandate identity, principal and delegate references, issuing authority and acceptance evidence","Entrusted objective, permitted and forbidden action-resource pairs, conditions, budgets and review gates","Temporal validity, permitted subdelegation, revision lineage, withdrawal evidence and external execution references"],"out":["Agent identity lifecycle, capabilities, prompts, memory, tool definitions and execution plans","Credential issuance, identity proofing, cryptographic verification, policy evaluation, enforcement and runtime audit-trail execution","Automatic legal agency, universal consent rules, contracting or financial execution, and safety-critical operating instructions"],"boundaries":[{"neighbor":"WM-AI-002 AI Agent","distinction":"Registry parent denotes context, not type inheritance. A mandate is not an agent. Reference the delegate master and revision binding without copying its lifecycle or capabilities."},{"neighbor":"WM-AI-004 AI Inference / Agent Run","distinction":"Runs supply observed activity and evidence references. Many runs can cite a mandate revision; a run does not prove authorization or own mandate terms."},{"neighbor":"WM-AI-005 Prompt / Agent Configuration and WM-AI-017 Tool Description","distinction":"Instructions and advertised tool capabilities do not grant authority. Bind versions by reference; untrusted content cannot amend mandate scope."},{"neighbor":"WM-AI-016 Agent Handoff Message","distinction":"A handoff carries task or context references. It neither creates a mandate nor implies permission to subdelegate."},{"neighbor":"Credential, policy decision and approval record masters","distinction":"This model records binding and evidence references only. A mandate may exist without a token; a valid token or approval document alone does not establish all mandate conditions."}]},"distinguishingFeatures":["Unlike WM-AI-002 AI Agent: Registry parent denotes context, not type inheritance. A mandate is not an agent. Reference the delegate master and revision binding without copying its lifecycle or capabilities.","Unlike WM-AI-004 AI Inference / Agent Run: Runs supply observed activity and evidence references. Many runs can cite a mandate revision; a run does not prove authorization or own mandate terms.","Unlike WM-AI-005 Prompt / Agent Configuration and WM-AI-017 Tool Description: Instructions and advertised tool capabilities do not grant authority. Bind versions by reference; untrusted content cannot amend mandate scope.","Unlike WM-AI-016 Agent Handoff Message: A handoff carries task or context references. It neither creates a mandate nor implies permission to subdelegate.","Unlike Credential, policy decision and approval record masters: This model records binding and evidence references only. A mandate may exist without a token; a valid token or approval document alone does not establish all mandate conditions."],"structure":{"bundles":[{"id":"mandate-parties","name":"Mandate and parties","description":"Identify the entrustment and the parties without collapsing their roles.","layers":[{"id":"mandate-identity-layer","name":"Mandate identity","description":"Keep relationship identity separate from a document revision, runtime session or token identifier.","findings":[{"id":"mandate-identity","name":"Stable mandate and revision","description":"Keep relationship identity separate from a document revision, runtime session or token identifier.","questions":[{"text":"Which master identifier denotes this mandate across revisions?","id":"mandate-identity-q01","kind":"identity"},{"text":"What kind of entrustment does the declared profile classify this as?","id":"mandate-identity-q02","kind":"classification"},{"text":"Which principal and delegate master records participate in this relationship?","id":"mandate-identity-q03","kind":"relationship"},{"text":"Which identity or authority changes require a new mandate rather than a revision?","id":"mandate-identity-q04","kind":"lifecycle"}]}]},{"id":"authority-basis-layer","name":"Entrusting authority","description":"Distinguish principal, issuer, delegate, approver and accountable reviewer; claims of authority require supporting references.","findings":[{"id":"authority-basis","name":"Authority and acceptance evidence","description":"Distinguish principal, issuer, delegate, approver and accountable reviewer; claims of authority require supporting references.","questions":[{"text":"Who may issue this mandate on the principal's behalf and under which authority reference?","id":"authority-basis-q01","kind":"authority"},{"text":"What evidence records the delegate's acceptance or refusal of the stated revision?","id":"authority-basis-q02","kind":"evidence"},{"text":"Who remains accountable for reviewing the entrusted work and its effects?","id":"authority-basis-q03","kind":"ownership"},{"text":"How is disputed or missing authority represented before the mandate can be relied on?","id":"authority-basis-q04","kind":"exception"}]}]}]},{"id":"entrusted-scope","name":"Entrusted work and scope","description":"Record why work was entrusted and the action-resource limits.","layers":[{"id":"purpose-outcome-layer","name":"Purpose and outcomes","description":"Describe the intended result and completion criteria without importing the task plan or claiming success.","findings":[{"id":"purpose-outcome","name":"Entrusted objective","description":"Describe the intended result and completion criteria without importing the task plan or claiming success.","questions":[{"text":"What bounded objective is entrusted to the delegate?","id":"purpose-outcome-q01","kind":"definition"},{"text":"Which deliverables and acceptance criteria define completion of this entrustment?","id":"purpose-outcome-q02","kind":"requirement"},{"text":"Which task or case references supply context without transferring their ownership?","id":"purpose-outcome-q03","kind":"composition"},{"text":"Which ambiguity in the objective requires clarification before consequential work?","id":"purpose-outcome-q04","kind":"decision"}]}]},{"id":"action-scope-layer","name":"Action and resource boundaries","description":"Represent explicit action-resource pairs and exclusions. Missing scope is unknown, not unrestricted.","findings":[{"id":"action-scope","name":"Permitted and prohibited work","description":"Represent explicit action-resource pairs and exclusions. Missing scope is unknown, not unrestricted.","questions":[{"text":"Which exact action-resource pairs are within this mandate?","id":"action-scope-q01","kind":"constraint"},{"text":"Which prohibitions still apply even when a broad objective suggests an action?","id":"action-scope-q02","kind":"security"},{"text":"Which recipient, tenant or resource audience limits apply to each permission?","id":"action-scope-q03","kind":"access"},{"text":"How will a binding avoid unintended combinations when projecting paired permissions?","id":"action-scope-q04","kind":"interoperability"}]}]}]},{"id":"conditions-oversight","name":"Conditions and oversight","description":"Bind resource limits, obligations and human decision points to the mandate.","layers":[{"id":"constraints-budget-layer","name":"Conditions and limits","description":"Proposed profile conditions can include expenditure, count, duration, data purpose and operating context; enforcement is external.","findings":[{"id":"constraints-budget","name":"Bounded resources and context","description":"Proposed profile conditions can include expenditure, count, duration, data purpose and operating context; enforcement is external.","questions":[{"text":"Which resource ceilings apply and what units and aggregation windows define them?","id":"constraints-budget-q01","kind":"measurement"},{"text":"Which time, location, data-use or environmental conditions restrict the entrusted work?","id":"constraints-budget-q02","kind":"spatial"},{"text":"Which duties must be satisfied before a permission may be exercised?","id":"constraints-budget-q03","kind":"requirement"},{"text":"What happens when a budget observation is stale, a unit is unknown or concurrent delegates share a ceiling?","id":"constraints-budget-q04","kind":"exception"}]}]},{"id":"oversight-gates-layer","name":"Review and escalation","description":"Specify review gates and escalation roles at policy level; an escalation cannot itself expand authority.","findings":[{"id":"oversight-gates","name":"Human review requirements","description":"Specify review gates and escalation roles at policy level; an escalation cannot itself expand authority.","questions":[{"text":"Which proposed effects require an authorized reviewer before proceeding?","id":"oversight-gates-q01","kind":"decision"},{"text":"What exact mandate revision and proposed action must a review decision bind?","id":"oversight-gates-q02","kind":"validation"},{"text":"Which unavailable-reviewer or emergency conditions require pause or refusal?","id":"oversight-gates-q03","kind":"exception"},{"text":"Where are incidents, complaints or conflicting instructions referred for resolution?","id":"oversight-gates-q04","kind":"process"}]}]}]},{"id":"delegation-chain","name":"Delegation and authority bindings","description":"Record subdelegation limits and credential mappings without creating authority by copying context.","layers":[{"id":"subdelegation-layer","name":"Subdelegation conditions","description":"A child mandate is a distinct relationship. Proposed attenuation rules require explicit permission and evidence of no widening.","findings":[{"id":"subdelegation","name":"Permitted onward entrustment","description":"A child mandate is a distinct relationship. Proposed attenuation rules require explicit permission and evidence of no widening.","questions":[{"text":"Does this mandate explicitly allow onward delegation and to which delegate class?","id":"subdelegation-q01","kind":"authority"},{"text":"Which parent revision and depth or expiry bounds must a child mandate preserve?","id":"subdelegation-q02","kind":"relationship"},{"text":"What evidence supports that a proposed child does not widen scope, budget or duties?","id":"subdelegation-q03","kind":"validation"},{"text":"How are cycles, missing ancestors and parent withdrawal handled without treating actor history as permission?","id":"subdelegation-q04","kind":"security"}]}]},{"id":"credential-binding-layer","name":"Technical authorization alignment","description":"Record external authorization bindings and discrepancies; never store bearer secrets or equate capability with permission.","findings":[{"id":"credential-binding","name":"Mandate to credential references","description":"Record external authorization bindings and discrepancies; never store bearer secrets or equate capability with permission.","questions":[{"text":"Which external grant or credential reference is bound to this mandate revision?","id":"credential-binding-q01","kind":"interoperability"},{"text":"Which evidence distinguishes the current actor from the represented principal?","id":"credential-binding-q02","kind":"identity"},{"text":"What authorization decision reference shows the actual allowed subset for a proposed action?","id":"credential-binding-q03","kind":"evidence"},{"text":"What prevents a handoff, prompt or credential refresh from silently widening the mandate?","id":"credential-binding-q04","kind":"constraint"}]}]}]},{"id":"validity-change","name":"Validity and change","description":"Record effective intervals, change decisions and withdrawal observations.","layers":[{"id":"effective-validity-layer","name":"Time and state","description":"Keep asserted status, effective interval and observation freshness distinct. Missing expiry is unresolved unless a profile explicitly governs it.","findings":[{"id":"effective-validity","name":"Mandate effectiveness","description":"Keep asserted status, effective interval and observation freshness distinct. Missing expiry is unresolved unless a profile explicitly governs it.","questions":[{"text":"When does this mandate revision become effective and when must it stop being relied on?","id":"effective-validity-q01","kind":"temporal"},{"text":"What evidence supports the asserted state as proposed, active, suspended, ended or disputed?","id":"effective-validity-q02","kind":"state"},{"text":"Which prerequisites and approvals must be current for reliance at a particular time?","id":"effective-validity-q03","kind":"requirement"},{"text":"How are clock uncertainty, missing status and offline operation handled?","id":"effective-validity-q04","kind":"quality"}]}]},{"id":"amend-withdraw-layer","name":"Amendment and withdrawal","description":"Record changes and end-of-authority decisions without claiming that credentials, running work or past effects were undone.","findings":[{"id":"amend-withdraw","name":"Revision and termination evidence","description":"Record changes and end-of-authority decisions without claiming that credentials, running work or past effects were undone.","questions":[{"text":"Who authorized an amendment, suspension, renewal or withdrawal and for which effective time?","id":"amend-withdraw-q01","kind":"authority"},{"text":"Which predecessor revision does the change supersede and how are conflicting edits detected?","id":"amend-withdraw-q02","kind":"lifecycle"},{"text":"Which downstream systems or child mandates require notification and what acknowledgements exist?","id":"amend-withdraw-q03","kind":"event"},{"text":"Which work or effects remain in flight after withdrawal and who owns stopping or remedying them?","id":"amend-withdraw-q04","kind":"process"}]}]}]},{"id":"evidence-assurance","name":"Evidence and assurance","description":"Link observation evidence and profile review without claiming operational compliance.","layers":[{"id":"evidence-accountability-layer","name":"Evidence and disclosure","description":"Reference execution and review evidence while retaining source, observation time and recipient-specific disclosure rules.","findings":[{"id":"evidence-accountability","name":"Mandate evidence index","description":"Reference execution and review evidence while retaining source, observation time and recipient-specific disclosure rules.","questions":[{"text":"Which run or decision evidence cites the mandate revision used at the time?","id":"evidence-accountability-q01","kind":"provenance"},{"text":"Which observed departures from the mandate are confirmed, disputed or still unknown?","id":"evidence-accountability-q02","kind":"quality"},{"text":"Who may see the principal, scope and evidence fields for a stated purpose?","id":"evidence-accountability-q03","kind":"privacy"},{"text":"Which retention, hold and disposal rules apply to mandate evidence and references?","id":"evidence-accountability-q04","kind":"retention"}]}]},{"id":"profile-assurance-layer","name":"Profile and conformance","description":"Pin the adopting profile, mapping versions and unresolved tests; a machine-valid research document is not an executable mandate schema.","findings":[{"id":"profile-assurance","name":"Adoption limits and mapping review","description":"Pin the adopting profile, mapping versions and unresolved tests; a machine-valid research document is not an executable mandate schema.","questions":[{"text":"Which profile defines vocabulary, conflict precedence and unknown handling for this mandate?","id":"profile-assurance-q01","kind":"classification"},{"text":"Which mappings preserve meaning and which extensions or losses remain unresolved?","id":"profile-assurance-q02","kind":"interoperability"},{"text":"What evidence tests expired, disputed, stale, over-budget and revoked-parent cases?","id":"profile-assurance-q03","kind":"validation"},{"text":"Which legal, sector or safety assumptions still need qualified review before use?","id":"profile-assurance-q04","kind":"constraint"}]}]}]}]},"agentConduct":{"may":["Register mandate proposal: Proposed local record operation, not implemented by this research package.","Record authority evidence: Proposed local record operation, not implemented by this research package.","Propose revised terms: Proposed local record operation, not implemented by this research package.","Link proposed child mandate: Proposed local record operation, not implemented by this research package.","Record withdrawal evidence: Proposed local record operation, not implemented by this research package.","Inspect record completeness: Proposed local record operation, not implemented by this research package."],"mustNot":["Mandate data is descriptive and must not be interpreted as a command to execute or an independently sufficient authorization.","Deny access unless recipient purpose and role are authorized by the adopting Dimension; access to read or edit a mandate never grants authority to perform the entrusted work."],"requiresHuman":["No automatic subdelegation, scope expansion, approval by silence or emergency override."]},"ethics":{"considerations":["Minimize personal data and secret-bearing references.","Principal, delegate, parent and child mandates, run and handoff references.","Qualified jurisdiction and sector review, including authority, consent, privacy and safety requirements.","Challenge child mandates that expand scope, exceed shared ceilings or outlive withdrawn parents.","Automatic legal agency, universal consent rules, contracting or financial execution, and safety-critical operating instructions"],"affectedParties":[]},"owners":{"steward":"Identify an accountable mandate steward, authority reviewer and evidence custodian by role and master reference.","roles":[{"name":"Principal","responsibilities":["Identifies intended work and the basis for entrustment."]},{"name":"Authorized issuer","responsibilities":["Provides evidence of authority to issue or change terms."]},{"name":"Delegate","responsibilities":["References the accepted revision and reports uncertainty or departures."]},{"name":"Authority reviewer","responsibilities":["Reviews scope, exceptions and material changes without relying solely on technical access."]},{"name":"Mandate steward","responsibilities":["Maintains identifiers, revisions, profiles and quality."]},{"name":"Evidence custodian","responsibilities":["Controls disclosure, retention and disposition of local evidence."]}],"masterSystems":[]},"relations":[{"target":"WM-AI-002","type":"references","note":"Candidate reference binding to the delegate master; registry parent is not inheritance. No agent lifecycle owned here. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft."},{"target":"WM-AI-004","type":"references","note":"Optional execution evidence references; run planning, execution, costs and audit trail remain in the run master. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft."},{"target":"WM-AI-005","type":"references","note":"Optional configuration version reference. Configuration text cannot amend authority. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft."},{"target":"WM-AI-016","type":"references","note":"Optional handoff reference carrying mandate identity; message transfer is not delegation authorization. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft."},{"target":"WM-AI-017","type":"references","note":"Optional tool description reference; interface capability is separate from permitted use. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft."},{"target":"RFC 8693","type":"aligned","note":"Conceptual current-actor and subject mapping, not actor-history authorization. No conformance claim."},{"target":"RFC 9396","type":"aligned","note":"Conceptual fine-grained authorization details mapping with pair preservation. No conformance claim."},{"target":"ODRL 2.2","type":"aligned","note":"Conceptual policy terms only; conflict and unknown rules need a specified profile. No conformance claim."},{"target":"PROV-O","type":"aligned","note":"Provenance alignment; provenance cannot establish current permission. No conformance claim."},{"target":"WM-AI-002 AI Agent","type":"neighbor","note":"Registry parent denotes context, not type inheritance. A mandate is not an agent. Reference the delegate master and revision binding without copying its lifecycle or capabilities."},{"target":"WM-AI-004 AI Inference / Agent Run","type":"neighbor","note":"Runs supply observed activity and evidence references. Many runs can cite a mandate revision; a run does not prove authorization or own mandate terms."},{"target":"WM-AI-005 Prompt / Agent Configuration and WM-AI-017 Tool Description","type":"neighbor","note":"Instructions and advertised tool capabilities do not grant authority. Bind versions by reference; untrusted content cannot amend mandate scope."},{"target":"WM-AI-016 Agent Handoff Message","type":"neighbor","note":"A handoff carries task or context references. It neither creates a mandate nor implies permission to subdelegate."},{"target":"Credential, policy decision and approval record masters","type":"neighbor","note":"This model records binding and evidence references only. A mandate may exist without a token; a valid token or approval document alone does not establish all mandate conditions."},{"target":"WM-AI-002","type":"parent"}],"interaction":{"identity":{"applicability":"required","items":["Authoritative master-system identifier","Governed global identifier or IRI","Dimension-assigned UUID or ULID"]},"properties":{"applicability":"not-applicable","items":[]},"recognition":{"applicability":"optional","items":[]},"capabilities":{"applicability":"required","items":["Register mandate proposal: Proposed local record operation, not implemented by this research package.","Record authority evidence: Proposed local record operation, not implemented by this research package.","Propose revised terms: Proposed local record operation, not implemented by this research package.","Link proposed child mandate: Proposed local record operation, not implemented by this research package.","Record withdrawal evidence: Proposed local record operation, not implemented by this research package.","Inspect record completeness: Proposed local record operation, not implemented by this research package."]},"hazards":{"applicability":"optional","items":[]},"interfaces":{"applicability":"required","items":["RFC 8693: OAuth 2.0 Token Exchange","RFC 9396: OAuth 2.0 Rich Authorization Requests","PROV-O: The PROV Ontology","RFC 7009: OAuth 2.0 Token Revocation","RFC 7662: OAuth 2.0 Token Introspection","NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations","NIST AI RMF 1.0: AI RMF Core"]},"context":{"applicability":"required","items":["No jurisdiction is assumed; authority and legal effect require the adopting profile and qualified review.","NIST guidance supplies conceptual context and is not a universal legal obligation."]}},"sources":[{"title":"RFC 8693: OAuth 2.0 Token Exchange","url":"https://www.rfc-editor.org/rfc/rfc8693.html","note":"IETF"},{"title":"RFC 9396: OAuth 2.0 Rich Authorization Requests","url":"https://www.rfc-editor.org/rfc/rfc9396.html","note":"IETF"},{"title":"ODRL Information Model 2.2","url":"https://www.w3.org/TR/odrl-model/","note":"W3C"},{"title":"PROV-O: The PROV Ontology","url":"https://www.w3.org/TR/prov-o/","note":"W3C"},{"title":"RFC 7009: OAuth 2.0 Token Revocation","url":"https://www.rfc-editor.org/rfc/rfc7009.html","note":"IETF"},{"title":"RFC 7662: OAuth 2.0 Token Introspection","url":"https://www.rfc-editor.org/rfc/rfc7662.html","note":"IETF"},{"title":"NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations","url":"https://csrc.nist.gov/pubs/sp/800/162/upd2/final","note":"NIST"},{"title":"NIST AI RMF 1.0: AI RMF Core","url":"https://airc.nist.gov/airmf-resources/airmf/5-sec-core/","note":"NIST"}],"openQuestions":["Restore independent external review and verify official versions, errata and claim support before canonical promotion.","Develop an adopting profile with qualified authority and sector review, concrete instance schemas and pinned trust and neighbor bindings.","Test ambiguous scope, unintended permission combinations, stale status, conflicting revisions, shared ceilings, child widening, parent withdrawal and delayed enforcement with external implementations.","Nested instance schema, units vocabulary, mapping implementations and executable adoption tests.","Qualified jurisdiction and sector review, including authority, consent, privacy and safety requirements.","Trust establishment, budget reservation, enforcement and revocation propagation implementation remain external.","Independent external review and current source/version/errata verification."],"resources":{"spec":"/models/wm-ai-015-agent-delegation-mandate/spec.yaml","agents":"/models/wm-ai-015-agent-delegation-mandate/AGENTS.md","source":"https://github.com/ver-cy/world-models/tree/feat/mega-model-registry/research/runs/wm-ai-015"},"provenance":{"origin":"world-models research","builtFrom":["models/wm-ai-015-agent-delegation-mandate/spec.yaml"],"providers":["Codex"],"researchStatus":"reviewable-draft","generatedAt":"2026-10-21T15:46:01Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"derived","structure":"filled","agentConduct":"derived","ethics":"derived","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"missing","interaction.capabilities":"filled","interaction.hazards":"missing","interaction.interfaces":"derived","interaction.context":"filled","sources":"filled"},"notes":{"distinguishingFeatures":"Derived from boundary notes against neighbouring models.","agentConduct":"Derived from functions, policies, CRUD and access rules; prohibitions were not authored for agents as such.","ethics":"Sentences mentioning harm, privacy, consent or similar, collected from the specification.","interaction.properties":"Institutional or informational subject: no invented physical properties."},"score":0.75}}