Mandate Guard

Enforce what you actually meant when your AI agent spends your money.

Agent payment rails handle numbers well: price caps, allowlists, spend limits. Half of what people write in an instruction is not a number. "Prefer refundable." "A reputable seller." Nothing in the stack enforces a sentence like that, and in AP2 the thing checking the cart against your intent is your own agent, the part most likely to be compromised.

How it works

1. You register a mandate in plain English. The operator posts a bond at least as large as the mandate allows spending.
2. The agent transacts immediately. Nothing in the purchase path waits on a judge.
3. Every purchase is recorded bound to the merchant's receipt. Validators fetch the receipt, check its SHA-256, and take the item, charged amount, purchaser and time from it; nothing about the purchase is self-reported.
4. Anyone can challenge inside a window, paying the exact deposit the contract reports.
5. GenLayer validators fetch the live listing themselves and each re-derive a verdict with their own LLM. Out of mandate, the bond is slashed to the principal. Within mandate, the challenger loses the deposit.
6. If nobody challenges, anyone can finalize the action once its window has closed.

The verdict is stored and structured: within_mandate, clause_violated, severity, reasoning, plus every payout leg.

Honest limits

• No bounty: a failed challenge loses the deposit and a successful one only returns it, so no third party is actually motivated to challenge. Only the principal is.
• Settlement is blunt. Severity is recorded but does not scale the payout, so a small deviation costs the whole bond.
• The mandate caps spend in dollars while the bond and deposit are GEN-wei. The ceiling is a declared parameter, never parsed out of the prose, and the two are not formally linked.
• An action can be challenged once ever, not once at a time.
• The demo merchant is ours. Its receipts are HMAC-signed at checkout, which proves they were issued by the merchant at purchase time, not that a card was charged.

Status

Working contract, Next.js UI, 84 direct tests, and integration tests under real five-validator consensus on studionet. The demo buys two fares, judges the non-refundable one out of mandate and slashes the bond, then finalizes the compliant purchase once its window closes.

Built for the GenLayer Agent Tank hackathon, September 2026. The demo merchant page is one we host ourselves, so judging does not depend on a third party's page; the validator fetch is still a real fetch of a real public URL.