Mandato: Protocol for Verifiable AI Agent Authorization and Audit Trails

As AI agents increasingly interact with external systems via tool-calling protocols, a critical gap exists in ensuring their actions are verifiably authorized by a principal. Current authorization logic often resides within application code, lacking digital signatures or independent auditability, which diminishes the evidentiary value of logs. Mandato proposes a novel governance proxy designed to enforce digitally signed mandates directly at the protocol level for AI agent actions. A mandate is a machine-readable, cryptographically signed artifact that specifies permissible tools, parameter constraints, contextual conditions, duration, and the authorizing entity. The proxy evaluates every tool call against this mandate chain, blocking unauthorized actions and recording all decisions—permits, denials, and their supporting evidence—in an append-only, hash-chained audit log. This log is periodically anchored with qualified timestamps, making it suitable for evidentiary purposes. The mandate model is intentionally structured to align with civil-law concepts of delegated authority, making it comprehensible to legal and auditing professionals, not just engineers. The paper details the mandate model, decision semantics, a reference architecture, and maps its mechanisms to key regulations like the EU AI Act, GDPR, NIS2, and eIDAS 2, outlining a path towards qualified attestation via Qualified Trust Service Providers.