Published

Agent Delegation Mandate

vr.wm-ai-015 · wm-ai-015-agent-delegation-mandate

Describe a versioned entrustment of bounded work to an identified agent on behalf of a principal, with authority evidence, limits, oversight and an effective interval.

World Models Information and virtual systems INF.AI.MND

Bundle → Layer → Finding → Questions Classifiers What it is Why it exists Distinguishing features What robots and AI may and may not do Moral aspects Owners Links to other meta-models Identity and identifiers Direct properties Recognition Capabilities and actions Hazards and failure modes Standards and interfaces Context of use Sources

Bundle → Layer → Finding → Questions Filled

6 bundles · 12 layers · 12 findings · 48 questions

Mandate and parties Identify the entrustment and the parties without collapsing their roles.

Mandate identity

Keep relationship identity separate from a document revision, runtime session or token identifier.

Stable mandate and revision

Keep relationship identity separate from a document revision, runtime session or token identifier.

Which master identifier denotes this mandate across revisions? identity
What kind of entrustment does the declared profile classify this as? classification
Which principal and delegate master records participate in this relationship? relationship
Which identity or authority changes require a new mandate rather than a revision? lifecycle

Entrusting authority

Distinguish principal, issuer, delegate, approver and accountable reviewer; claims of authority require supporting references.

Authority and acceptance evidence

Distinguish principal, issuer, delegate, approver and accountable reviewer; claims of authority require supporting references.

Who may issue this mandate on the principal's behalf and under which authority reference? authority
What evidence records the delegate's acceptance or refusal of the stated revision? evidence
Who remains accountable for reviewing the entrusted work and its effects? ownership
How is disputed or missing authority represented before the mandate can be relied on? exception

Entrusted work and scope Record why work was entrusted and the action-resource limits.

Purpose and outcomes

Describe the intended result and completion criteria without importing the task plan or claiming success.

Entrusted objective

Describe the intended result and completion criteria without importing the task plan or claiming success.

What bounded objective is entrusted to the delegate? definition
Which deliverables and acceptance criteria define completion of this entrustment? requirement
Which task or case references supply context without transferring their ownership? composition
Which ambiguity in the objective requires clarification before consequential work? decision

Action and resource boundaries

Represent explicit action-resource pairs and exclusions. Missing scope is unknown, not unrestricted.

Permitted and prohibited work

Represent explicit action-resource pairs and exclusions. Missing scope is unknown, not unrestricted.

Which exact action-resource pairs are within this mandate? constraint
Which prohibitions still apply even when a broad objective suggests an action? security
Which recipient, tenant or resource audience limits apply to each permission? access
How will a binding avoid unintended combinations when projecting paired permissions? interoperability

Conditions and oversight Bind resource limits, obligations and human decision points to the mandate.

Conditions and limits

Proposed profile conditions can include expenditure, count, duration, data purpose and operating context; enforcement is external.

Bounded resources and context

Proposed profile conditions can include expenditure, count, duration, data purpose and operating context; enforcement is external.

Which resource ceilings apply and what units and aggregation windows define them? measurement
Which time, location, data-use or environmental conditions restrict the entrusted work? spatial
Which duties must be satisfied before a permission may be exercised? requirement
What happens when a budget observation is stale, a unit is unknown or concurrent delegates share a ceiling? exception

Review and escalation

Specify review gates and escalation roles at policy level; an escalation cannot itself expand authority.

Human review requirements

Specify review gates and escalation roles at policy level; an escalation cannot itself expand authority.

Which proposed effects require an authorized reviewer before proceeding? decision
What exact mandate revision and proposed action must a review decision bind? validation
Which unavailable-reviewer or emergency conditions require pause or refusal? exception
Where are incidents, complaints or conflicting instructions referred for resolution? process

Delegation and authority bindings Record subdelegation limits and credential mappings without creating authority by copying context.

Subdelegation conditions

A child mandate is a distinct relationship. Proposed attenuation rules require explicit permission and evidence of no widening.

Permitted onward entrustment

A child mandate is a distinct relationship. Proposed attenuation rules require explicit permission and evidence of no widening.

Does this mandate explicitly allow onward delegation and to which delegate class? authority
Which parent revision and depth or expiry bounds must a child mandate preserve? relationship
What evidence supports that a proposed child does not widen scope, budget or duties? validation
How are cycles, missing ancestors and parent withdrawal handled without treating actor history as permission? security

Technical authorization alignment

Record external authorization bindings and discrepancies; never store bearer secrets or equate capability with permission.

Mandate to credential references

Record external authorization bindings and discrepancies; never store bearer secrets or equate capability with permission.

Which external grant or credential reference is bound to this mandate revision? interoperability
Which evidence distinguishes the current actor from the represented principal? identity
What authorization decision reference shows the actual allowed subset for a proposed action? evidence
What prevents a handoff, prompt or credential refresh from silently widening the mandate? constraint

Validity and change Record effective intervals, change decisions and withdrawal observations.

Time and state

Keep asserted status, effective interval and observation freshness distinct. Missing expiry is unresolved unless a profile explicitly governs it.

Mandate effectiveness

Keep asserted status, effective interval and observation freshness distinct. Missing expiry is unresolved unless a profile explicitly governs it.

When does this mandate revision become effective and when must it stop being relied on? temporal
What evidence supports the asserted state as proposed, active, suspended, ended or disputed? state
Which prerequisites and approvals must be current for reliance at a particular time? requirement
How are clock uncertainty, missing status and offline operation handled? quality

Amendment and withdrawal

Record changes and end-of-authority decisions without claiming that credentials, running work or past effects were undone.

Revision and termination evidence

Record changes and end-of-authority decisions without claiming that credentials, running work or past effects were undone.

Who authorized an amendment, suspension, renewal or withdrawal and for which effective time? authority
Which predecessor revision does the change supersede and how are conflicting edits detected? lifecycle
Which downstream systems or child mandates require notification and what acknowledgements exist? event
Which work or effects remain in flight after withdrawal and who owns stopping or remedying them? process

Evidence and assurance Link observation evidence and profile review without claiming operational compliance.

Evidence and disclosure

Reference execution and review evidence while retaining source, observation time and recipient-specific disclosure rules.

Mandate evidence index

Reference execution and review evidence while retaining source, observation time and recipient-specific disclosure rules.

Which run or decision evidence cites the mandate revision used at the time? provenance
Which observed departures from the mandate are confirmed, disputed or still unknown? quality
Who may see the principal, scope and evidence fields for a stated purpose? privacy
Which retention, hold and disposal rules apply to mandate evidence and references? retention

Profile and conformance

Pin the adopting profile, mapping versions and unresolved tests; a machine-valid research document is not an executable mandate schema.

Adoption limits and mapping review

Pin the adopting profile, mapping versions and unresolved tests; a machine-valid research document is not an executable mandate schema.

Which profile defines vocabulary, conflict precedence and unknown handling for this mandate? classification
Which mappings preserve meaning and which extensions or losses remain unresolved? interoperability
What evidence tests expired, disputed, stale, over-budget and revoked-parent cases? validation
Which legal, sector or safety assumptions still need qualified review before use? constraint

Classifiers Filled

Family: World Models
Category: Information and virtual systems
Entry kind: relationship
Navigation path: NAV.INF.AI.MND
Domain: INF.AI.MND
Industry: Cross-industry
Tags: agentdelegationmandateinf.ai.mnd

What it is Filled

One identified delegation relationship and its mandate revisions. The root connects a principal, delegate and authorized work context; it records asserted terms and evidence without issuing credentials or deciding runtime access. Proposed, accepted, disputed, suspended and ended mandates remain distinguishable. This is a proposed format-neutral research model, not an executable authorization or legal instrument.

In scope

Mandate identity, principal and delegate references, issuing authority and acceptance evidence
Entrusted objective, permitted and forbidden action-resource pairs, conditions, budgets and review gates
Temporal validity, permitted subdelegation, revision lineage, withdrawal evidence and external execution references

Out of scope

Agent identity lifecycle, capabilities, prompts, memory, tool definitions and execution plans
Credential issuance, identity proofing, cryptographic verification, policy evaluation, enforcement and runtime audit-trail execution
Automatic legal agency, universal consent rules, contracting or financial execution, and safety-critical operating instructions

Why it exists Filled

Describe a versioned entrustment of bounded work to an identified agent on behalf of a principal, with authority evidence, limits, oversight and an effective interval.

Distinguishing features Derived, awaiting review

Unlike WM-AI-002 AI Agent: Registry parent denotes context, not type inheritance. A mandate is not an agent. Reference the delegate master and revision binding without copying its lifecycle or capabilities.
Unlike WM-AI-004 AI Inference / Agent Run: Runs supply observed activity and evidence references. Many runs can cite a mandate revision; a run does not prove authorization or own mandate terms.
Unlike WM-AI-005 Prompt / Agent Configuration and WM-AI-017 Tool Description: Instructions and advertised tool capabilities do not grant authority. Bind versions by reference; untrusted content cannot amend mandate scope.
Unlike WM-AI-016 Agent Handoff Message: A handoff carries task or context references. It neither creates a mandate nor implies permission to subdelegate.
Unlike Credential, policy decision and approval record masters: This model records binding and evidence references only. A mandate may exist without a token; a valid token or approval document alone does not establish all mandate conditions.

Note: Derived from boundary notes against neighbouring models.

What robots and AI may and may not do Derived, awaiting review

Must not

Mandate data is descriptive and must not be interpreted as a command to execute or an independently sufficient authorization.
Deny access unless recipient purpose and role are authorized by the adopting Dimension; access to read or edit a mandate never grants authority to perform the entrusted work.

Only with a human decision

No automatic subdelegation, scope expansion, approval by silence or emergency override.

May

Register mandate proposal: Proposed local record operation, not implemented by this research package.
Record authority evidence: Proposed local record operation, not implemented by this research package.
Propose revised terms: Proposed local record operation, not implemented by this research package.
Link proposed child mandate: Proposed local record operation, not implemented by this research package.
Record withdrawal evidence: Proposed local record operation, not implemented by this research package.
Inspect record completeness: Proposed local record operation, not implemented by this research package.

Note: Derived from functions, policies, CRUD and access rules; prohibitions were not authored for agents as such.

Moral aspects Derived, awaiting review

Minimize personal data and secret-bearing references.
Principal, delegate, parent and child mandates, run and handoff references.
Qualified jurisdiction and sector review, including authority, consent, privacy and safety requirements.
Challenge child mandates that expand scope, exceed shared ceilings or outlive withdrawn parents.
Automatic legal agency, universal consent rules, contracting or financial execution, and safety-critical operating instructions

Note: Sentences mentioning harm, privacy, consent or similar, collected from the specification.

Owners Filled

Steward

Identify an accountable mandate steward, authority reviewer and evidence custodian by role and master reference.

Roles

Principal: Identifies intended work and the basis for entrustment.
Authorized issuer: Provides evidence of authority to issue or change terms.
Delegate: References the accepted revision and reports uncertainty or departures.
Authority reviewer: Reviews scope, exceptions and material changes without relying solely on technical access.
Mandate steward: Maintains identifiers, revisions, profiles and quality.
Evidence custodian: Controls disclosure, retention and disposition of local evidence.

Links to other meta-models Filled

references

WM-AI-002 - Candidate reference binding to the delegate master; registry parent is not inheritance. No agent lifecycle owned here. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft.
WM-AI-004 - Optional execution evidence references; run planning, execution, costs and audit trail remain in the run master. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft.
WM-AI-005 - Optional configuration version reference. Configuration text cannot amend authority. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft.
WM-AI-016 - Optional handoff reference carrying mandate identity; message transfer is not delegation authorization. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft.
WM-AI-017 - Optional tool description reference; interface capability is separate from permitted use. Instance profiles must resolve and pin required bindings; no runtime dependency is installed by this draft.

aligned

RFC 8693 - Conceptual current-actor and subject mapping, not actor-history authorization. No conformance claim.
RFC 9396 - Conceptual fine-grained authorization details mapping with pair preservation. No conformance claim.
ODRL 2.2 - Conceptual policy terms only; conflict and unknown rules need a specified profile. No conformance claim.
PROV-O - Provenance alignment; provenance cannot establish current permission. No conformance claim.

neighbor

WM-AI-002 AI Agent - Registry parent denotes context, not type inheritance. A mandate is not an agent. Reference the delegate master and revision binding without copying its lifecycle or capabilities.
WM-AI-004 AI Inference / Agent Run - Runs supply observed activity and evidence references. Many runs can cite a mandate revision; a run does not prove authorization or own mandate terms.
WM-AI-005 Prompt / Agent Configuration and WM-AI-017 Tool Description - Instructions and advertised tool capabilities do not grant authority. Bind versions by reference; untrusted content cannot amend mandate scope.
WM-AI-016 Agent Handoff Message - A handoff carries task or context references. It neither creates a mandate nor implies permission to subdelegate.
Credential, policy decision and approval record masters - This model records binding and evidence references only. A mandate may exist without a token; a valid token or approval document alone does not establish all mandate conditions.

parent

WM-AI-002

What else AI and robots need to interact with it Incomplete

Sources Filled

RFC 8693: OAuth 2.0 Token Exchange - IETF
RFC 9396: OAuth 2.0 Rich Authorization Requests - IETF
ODRL Information Model 2.2 - W3C
PROV-O: The PROV Ontology - W3C
RFC 7009: OAuth 2.0 Token Revocation - IETF
RFC 7662: OAuth 2.0 Token Introspection - IETF
NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations - NIST
NIST AI RMF 1.0: AI RMF Core - NIST

Open questions

Restore independent external review and verify official versions, errata and claim support before canonical promotion.
Develop an adopting profile with qualified authority and sector review, concrete instance schemas and pinned trust and neighbor bindings.
Test ambiguous scope, unintended permission combinations, stale status, conflicting revisions, shared ceilings, child widening, parent withdrawal and delayed enforcement with external implementations.
Nested instance schema, units vocabulary, mapping implementations and executable adoption tests.
Qualified jurisdiction and sector review, including authority, consent, privacy and safety requirements.
Trust establishment, budget reservation, enforcement and revocation propagation implementation remain external.
Independent external review and current source/version/errata verification.

Machine files

Card as JSON Specification AGENTS.md Source Card backlog vercy.card/1

Provenance

world-models research · reviewable-draft

Built from: models/wm-ai-015-agent-delegation-mandate/spec.yaml