Input schema (JSON)
{
"type": "object",
"examples": [
{
"action": {
"operation": {
"kind": "file",
"verb": "read",
"target": "/tmp/example"
},
"requested_by": {
"agent": "example-agent"
},
"justification": "Read the permitted file.",
"schema_version": "0.1-draft"
},
"mandate": {
"clauses": [
{
"id": "permit-file",
"match": {
"kind": [
"file"
]
},
"effect": "permit"
}
],
"default": "deny",
"purpose": "Permit one file action.",
"mandate_id": "minimal-permit",
"schema_version": "0.2-draft"
}
},
{
"action": {
"operation": {
"kind": "transaction",
"verb": "transfer",
"amount": {
"value": "25",
"currency": "USDC"
},
"target": "eip155:11155111/0x1111111111111111111111111111111111111111/transfer",
"counterparty": "0x2222222222222222222222222222222222222222"
},
"requested_by": {
"agent": "example-agent"
},
"justification": "Pay the invoiced supplier.",
"schema_version": "0.1-draft"
},
"mandate": {
"clauses": [
{
"id": "small-transfers",
"match": {
"kind": [
"transaction"
],
"verb": [
"transfer"
],
"max_amount": {
"value": "100",
"currency": "USDC"
},
"counterparty": [
"0x2222222222222222222222222222222222222222"
],
"target_prefix": [
"eip155:11155111/0x1111111111111111111111111111111111111111/"
]
},
"effect": "permit"
}
],
"default": "escalate",
"purpose": "Permit small transfers to one named recipient on a test network.",
"mandate_id": "example-payments",
"schema_version": "0.2-draft"
}
}
],
"required": [
"mandate",
"action"
],
"properties": {
"action": {
"type": "object",
"title": "HANRIA action request",
"$comment": "Forbidden anywhere in an instance: credential, secret, private_key, token, password, api_key. A runtime is expected to refuse a request containing them rather than strip them.",
"required": [
"schema_version",
"requested_by",
"operation",
"justification"
],
"properties": {
"operation": {
"type": "object",
"required": [
"kind",
"verb",
"target"
],
"properties": {
"kind": {
"enum": [
"file",
"process",
"package",
"network",
"device",
"credential_use",
"transaction",
"administrative"
]
},
"verb": {
"type": "string",
"minLength": 1,
"description": "What is to be done to the target, e.g. read, write, execute, install, connect, sign, transfer. Required: an operation named only by its kind does not describe a proposed action well enough to be judged."
},
"amount": {
"type": "object",
"required": [
"value",
"currency"
],
"properties": {
"value": {
"type": "string",
"minLength": 1,
"description": "Decimal as a string, to avoid float error."
},
"currency": {
"type": "string",
"minLength": 1
}
},
"description": "An amount. Both fields are required: a bare amount object describes nothing a ceiling could be compared against.",
"additionalProperties": false
},
"target": {
"type": "string",
"minLength": 1,
"description": "What the operation acts on. A path, host, package name, or resource identifier. NEVER a secret. Required for the same reason as the verb."
},
"parameters": {
"type": "object",
"description": "Non-secret parameters. A runtime MUST reject any request whose parameters appear to contain a credential."
},
"counterparty": {
"type": "string"
}
},
"additionalProperties": false
},
"mandate_ref": {
"type": "string",
"description": "Optional reference to the owner-defined mandate the agent believes authorizes this."
},
"requested_by": {
"type": "object",
"required": [
"agent"
],
"properties": {
"agent": {
"type": "string",
"description": "Identifier of the requesting agent."
},
"session": {
"type": "string",
"description": "Optional session or task identifier."
},
"on_behalf_of": {
"type": "string",
"description": "Optional identifier of the human or system the agent acts for."
}
},
"additionalProperties": false
},
"justification": {
"type": "string",
"minLength": 1,
"description": "Why the agent believes this is within its mandate. Free text, for the record."
},
"schema_version": {
"const": "0.1-draft",
"description": "Draft. The runtime does not exist; this shape may change."
},
"idempotency_key": {
"type": "string",
"description": "Optional. Lets a runtime refuse a duplicate rather than perform an operation twice."
}
},
"description": "A typed description of a proposed operation, submitted by an agent to a local HANRIA runtime. MUST NOT contain credentials, secrets, private keys, or tokens.",
"additionalProperties": false
},
"mandate": {
"type": "object",
"title": "HANRIA mandate",
"$comment": "A mandate names what may be done, not the means of doing it, and must never contain a credential, secret, key or token. The checker refuses a mandate carrying recognizable credential material rather than evaluating it, because anything in a clause note is copied into the decision record. That detection is a heuristic and cannot be complete.",
"required": [
"schema_version",
"mandate_id",
"purpose",
"default",
"clauses"
],
"properties": {
"clauses": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"effect",
"match"
],
"properties": {
"id": {
"type": "string",
"minLength": 1,
"description": "Identifier for this clause. Returned with every decision so a reviewer can see which sentence of the mandate was relied on."
},
"note": {
"type": "string",
"description": "Why this clause exists. Carried into the decision record verbatim."
},
"match": {
"type": "object",
"required": [
"kind"
],
"properties": {
"kind": {
"type": "array",
"items": {
"enum": [
"file",
"process",
"package",
"network",
"device",
"credential_use",
"transaction",
"administrative"
]
},
"minItems": 1,
"description": "Operation kinds this clause covers."
},
"verb": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1,
"description": "Permitted verbs, matched case-insensitively and exactly. Absent means any verb."
},
"max_amount": {
"type": "object",
"required": [
"value",
"currency"
],
"properties": {
"value": {
"type": "string",
"description": "Decimal as a string, to avoid float error."
},
"currency": {
"type": "string"
}
},
"description": "Ceiling for an operation carrying an amount. A request above it does not match this clause.",
"additionalProperties": false
},
"counterparty": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1,
"description": "Permitted counterparties, matched exactly. Absent means any counterparty."
},
"target_prefix": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1,
"description": "The operation target must begin with one of these strings. Absent means any target. Prefix matching is deliberately literal: it does not resolve symlinks, normalize paths, or understand hostnames, so a target is compared as written."
}
},
"description": "All present conditions must hold for the clause to match.",
"additionalProperties": false
},
"effect": {
"enum": [
"permit",
"deny",
"escalate"
],
"description": "What this clause does when it matches."
}
},
"additionalProperties": false
},
"minItems": 1,
"description": "Evaluated in order. The first matching clause decides. A request matching no clause takes the mandate default."
},
"default": {
"enum": [
"deny",
"escalate"
],
"description": "What happens when no clause matches. 'permit' is deliberately not an option: a mandate that permits by default cannot express a limit."
},
"purpose": {
"type": "string",
"minLength": 1,
"description": "What the agent is authorized to accomplish, in the operator's own words. Not evaluated mechanically; it is the human-readable statement against which a reviewer judges whether the clauses actually express the intent."
},
"issued_by": {
"type": "string",
"description": "Who wrote this mandate. Free text; not authenticated by anything in this skill."
},
"mandate_id": {
"type": "string",
"minLength": 1,
"description": "Stable identifier for this mandate. Appears in every decision record made against it."
},
"requires_human": {
"type": "array",
"items": {
"enum": [
"file",
"process",
"package",
"network",
"device",
"credential_use",
"transaction",
"administrative"
]
},
"minItems": 0,
"description": "Operation kinds that always require a person, even where a clause permits them. These escalate rather than permit."
},
"schema_version": {
"const": "0.2-draft",
"description": "Draft. The shape may change while the runtime is in development."
},
"not_valid_after": {
"type": "string",
"format": "date-time",
"description": "RFC 3339 timestamp. After this instant every action is denied. Absent means no expiry, which is discouraged: an unbounded mandate is the condition that lets delegated authority outlive the task it was granted for."
}
},
"description": "An operator-authored statement of what an agent may do. Written by a person, read by an agent, evaluated locally. A mandate is advisory: it describes intended authority and supports a local check, but it does not enforce anything. Enforcement requires a component that exclusively holds the credentials and can refuse.",
"additionalProperties": false
}
},
"additionalProperties": false
}