Product — Mandaton

Verify

Two independent questions, deliberately kept apart. Agent identity: which piece of software is this? Today that is Web Bot Auth and HTTP Message Signatures (RFC 9421), plus operator key directories — proof that the request comes from a known agent and was not altered in transit. Principal mandate: on whose behalf, and with what authority? From the wallet rollout onwards that is a mandate credential over OID4VP, in SD-JWT VC or mdoc form, HAIP-conformant. Until then: contractual registration of principals plus delegations signed by the agent operator.

Separating the two is essential. A verified agent without a mandate is still a stranger wearing a name badge.

Policy

A rule engine per tenant, with rules a risk manager can read:

policy: eu-webshop-default
rules:
  - id: purchase-default
    when:
      intent: purchase
    require:
      agent_verified: true
      max_amount: "500.00 EUR"
    decision: allow
    otherwise: review

  - id: scrape-allowlist
    when:
      intent: scrape
    require:
      agent_verified: true
      operator_in: ["agents.example"]
    decision: allow
    otherwise: deny
default: deny

Outcomes are always allow, review or deny. Review is a first-class citizen: the AI Act requires human oversight with the ability to intervene, so escalation to a person is a core path, not an edge case.

Policy versions are immutable. A receipt points at the version that was applied, so a decision stays explainable after the rules change — enforced in the database, not by convention.

Seal & log

Every decision produces a receipt, canonicalised and hashed, appended to an append-only Merkle log with a signed tree head. Each receipt gets a public URL where a counterparty can recompute the hash and check the inclusion proof without an account and without asking us.

The qualified electronic seal from a trust service provider (QTSP) is the next milestone. Sealing is asynchronous by design: the decision returns immediately, the hash is already fixed, and a slow trust provider can never block a checkout.

A by-product we sell on purpose: the log is directly usable as evidence under AI Act Article 12, including its 6- and 24-month retention periods.

Settle

The bridge from “allowed” to “legally settled”: SEPA Instant and e-invoicing over Peppol / EN 16931, so an agent transaction produces an invoice your customer's finance department accepts. Later phase — listed because it is where this is going.

What we deliberately do not build

No wallet. There will be 27 of them and that market is taken.
No agent framework. We are not on the agent builder's side of the table.
No behavioural bot detection or fingerprinting. That is a commodity, and it is heuristics. We work with cryptographic proof.
No general GRC platform. The AI Act export is a feature of the log, not a second product.

Who this is for