Granting a mandate is a ceremony, not a setting.
31 July 2026 · the launch journal
You are about to hand an agent the ability to write supply-chain evidence under your organization's name. The worst possible way to do that is the way almost everyone does it: paste a shared API key into its environment and hope. This entry is for the person performing the grant — what the ceremony is, what it binds, and why everything the agent does afterward traces to you having done it.
Shared keys are anti-evidence
A shared key answers exactly one question: did the caller possess the string? It does not say who decided the agent may act, what the agent may act on, how much it may commit, or when the permission dies. When a dispute arrives — and the entire point of an event record is that disputes arrive — a shared key gives you a pile of writes and no decision behind any of them. Nothing traces to a human judgment, which means everything traces to "whoever had the key," which is nobody.
An event record built for evidence needs the opposite: every write inside a granted authority, every authority inside a recorded decision.
The ceremony, part by part
Deputization here is the typed verb provisionAgentSeat, and its audience is human — it is the one surface in this system built for a person equipping something else to act, rather than for the actor itself. The published contract at /icp.json states the two authority modes it separates, verbatim:
"deputized": "the ask goes to the deputizing human; the agent carries realised value as proof" "self-principal": "may transact against its own Mandate ceiling"
The ceremony binds four things, and refuses to complete without them:
| part | what it binds | what it prevents |
|---|---|---|
| who grants | a named human seat — you, not your team alias | "the org did it" with no decider |
| what scope | the verbs and record surfaces the seat may touch | an agent provisioned to validate that quietly starts capturing |
| what ceiling | the mandate band the seat may commit without asking | an unbounded agent with a bounded job |
| when it dies | an expiry on the grant itself | permissions that outlive the project, the quarter, the employee |
The output is an agent seat whose grant compiles down to spine-native scope — the same authority machinery every door on this origin enforces, not a parallel "AI permissions" table bolted on beside it.
What the record shows afterward
Suppose the seat you provisioned is a dock-side verifier agent, and it captures a receiving event. Two distinct fields carry two distinct facts, and the distinction is the whole product:
- who is the attested observer — the agent identity that actually saw the goods, e.g. the spine:who carried in the golden corpus's attested-observer fixture: "spine:who": "https://id.org.ai/agents/dock-scanner-7".
- capturedBy is the warrantor account — the seat that stands behind the capture, stamped by the gateway, never supplied by the caller.
capturedBy resolves through the grant chain to your ceremony: this seat, under this scope and this ceiling, conferred by this named human, expiring on this date. Who saw it, and who stands behind it, answered separately — because in the dispute that matters, they are different questions. Collapsing them destroys exactly the evidence you performed the ceremony to create. The full argument for the two grains is the performer page.
And note what the ceremony does not stamp: your organization. Party and org grain are derived at read time from the grant chain, never written onto the event. When your company reorganizes, when the agent seat moves teams, when you revoke the grant tomorrow morning — no event is rewritten, because no event ever carried the org assignment in the first place. Revocation changes what the chain derives from the revocation date forward; history stays exactly as observed. An append-only record with mutable org stamps is a contradiction; this design refuses the contradiction structurally.
Why an expiry is a feature, not friction
Every standing permission in every company is a small archaeology problem: nobody remembers why it exists, so nobody dares remove it. A mandate with an expiry inverts that. The default is death; continuation is a fresh decision by a human who still exists and still means it. For agent seats — which are cheap to create and cheaper to forget — this is the difference between an authority surface you can enumerate and one you can only excavate.
The agent's own experience inside the grant is covered in What the ceiling buys: inside scope and under the ceiling it acts without asking; at the boundary it escalates to you with evidence, never negotiates. And when an agent with no registered channel hits a human gate, the system fails closed with a typed refusal — No channel, no grant — which is the same design honesty pointed the other direction.
Where this stands
The engine doors on this origin — POST /translate, /validate, /hash — answer today with no key and no ceremony, because pure computation needs no mandate. Seats, grants, and the durable authority they compile to ride the spine's stateful side, and the dated ledger at /what-ships-today/ is authoritative for where that stands. If you are the human who will perform this ceremony for your organization, say so at the key list — say what your agent will capture, answer the short set of questions about how authority works in your shop today, and the final step locks. Keys are provisioned from that list, in order — one email when yours is ready.
We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.