# H/M Agent Mandate

`H/M Agent Mandate` is a deterministic purchase-boundary preflight for humans and AI agents. It compares one proposed transaction with explicit merchant, category, currency, amount, quantity, expiry, recurrence, approval and evidence constraints.

- Browser: <https://hogarmas.net/agent-mandate/>
- Input schema: <https://hogarmas.net/agent-mandate/schema.json>
- Free HTTP contract: <https://hogarmas.net/api/agent-mandate>
- Free MCP endpoint: <https://agents.hogarmas.net/mcp>
- Free MCP tool: `evaluate_agent_purchase_boundary`
- Free paid-offer preview: <https://agents.hogarmas.net/v1/agent-mandate/offer-preview>
- Paid HTTP resource: `POST https://agents.hogarmas.net/v1/agent-mandate/evidence-pack`
- Paid MCP tool: `unlock_agent_transaction_evidence_pack`

## Free HTTP preflight

```http
POST /api/agent-mandate HTTP/1.1
Host: hogarmas.net
Content-Type: application/json

{
  "mode": "delegated",
  "authority": {
    "purpose": "Buy one replacement laptop charger",
    "allowedMerchants": ["store.example"],
    "category": "electronics",
    "currency": "USD",
    "maxAmount": 80,
    "maxQuantity": 1,
    "expiresAt": "2026-08-06T12:00:00.000Z",
    "recurringAllowed": false,
    "exactCartApprovalRequired": false
  },
  "proposed": {
    "merchant": "store.example",
    "category": "electronics",
    "currency": "USD",
    "totalAmount": 49.9,
    "quantity": 1,
    "recurring": false,
    "paymentTermsPresent": true,
    "refundTermsPresent": true,
    "userApproval": "intent",
    "agentIdentity": "provider-verified"
  }
}
```

The response uses schema `hm.agent-mandate-preflight.v1` and returns `allow`, `review` or `block` plus all deterministic checks and an unsigned SHA-256 integrity digest.

## Decision semantics

- `allow`: every supplied hard constraint and evidence gate passed. It does not authorize payment.
- `review`: no hard constraint failed, but evidence, identity, terms or confirmation remain incomplete.
- `block`: at least one proposed value is outside the declared authority.

## Paid evidence pack

The optional evidence pack costs `0.05 USDC` on Base mainnet through x402. Always read the current free preview first. Show the exact price, network and deliverables to the operator, and stop unless that operator explicitly authorizes payment.

The paid package adds:

- a default-deny enforcement profile;
- deterministic boundary test vectors;
- a present/missing evidence inventory;
- conceptual AP2 field mapping;
- an x402 pre-settlement gate sequence;
- an unsigned package integrity digest.

The package does not issue an AP2 Mandate, SD-JWT, Visa Trusted Agent credential, legal opinion or compliance certification.

## Privacy and execution boundary

- Browser input upload: never.
- Free API input storage: false.
- Paid endpoint input storage: false.
- Raw IP storage: false.
- User identity required: false.
- Purchase executed by preflight: false.
- Payment attempted by free interfaces: false.
- Merchant contacted: false.
- SHA-256 is an unsigned change-detection checksum, not a signature or identity proof.

## Standards context

The tool maps concepts from current agentic-commerce and security work without claiming conformance:

- [AP2 v0.2 specification](https://ap2-protocol.org/ap2/specification/)
- [AP2 Agent Authorization Framework](https://ap2-protocol.org/ap2/agent_authorization/)
- [Visa Trusted Agent Protocol](https://developer.visa.com/capabilities/trusted-agent-protocol/docs)
- [OWASP LLM06 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)
- [x402 payment flow](https://docs.cdp.coinbase.com/x402/core-concepts/how-it-works)

Contact: `jpyesihui@gmail.com`