Proxy enforces signed mandates on AI agents

Problem

The paper studies the absence of an infrastructural, auditable means to constrain what AI agents are authorised to do when they call external tools through standard protocols such as the Model Context Protocol. Today authorisation is embedded in application code, enforcement is not independently verifiable, and logs lack evidentiary quality. This gap undermines accountability, auditability and regulatory compliance under regimes such as the EU AI Act, GDPR, NIS2 and eIDAS 2.

Approach

The authors propose MANDATO, a governance proxy that enforces machine-readable, cryptographically signed mandates at the protocol chokepoint between agents and tool servers. A mandate specifies who delegates to which agent, which tools and parameter constraints are permitted, oversight class (automatic, confirm, forbid), validity windows, quotas and delegation rules. The proxy acts as an MCP-transparent intermediary that separates a policy decision point from a minimal, fail-closed enforcement point, evaluates every intercepted tool call deterministically against applicable mandate chains, and records each decision in an append-only, hash-chained audit log. Periodic checkpoints are timestamped, with a roadmap to qualified timestamps and signatures via Qualified Trust Service Providers to obtain eIDAS legal presumption of integrity. The reference implementation is tracked from a specification v0.6 with 170+ requirements and 22 use cases, and an explicit evaluation plan for enforcement overhead, audit completeness and verifier cost.

Key Findings

• Mandates as first-class artefacts: A machine-readable, digitally signed mandate model is defined, including scope over tools and parameters, contextual conditions, validity windows, delegation semantics and revocation/ratification mechanics.
• Protocol-level enforcement: Deploying MANDATO as an MCP-terminating proxy yields architectural completeness and non-bypassability so every tool discovery, invocation and result traverses the enforcement point.
• Deterministic, deny-by-default decisions: Authorization decisions are deterministic, LLM-free and collapse to DENY for missing, expired or unverifiable mandates or out-of-language constraints; oversight classes enable automatic execution, human confirmation or outright forbiddance per grant.
• Cryptographically chained, evidentiary logs: Every permit, deny or escalation produces a record with per-predicate traces and cryptographic hash chaining; periodic RFC 3161 or qualified timestamps provide external anchoring for independent verification.
• Regulatory alignment: The mechanism is explicitly mapped to obligations in AI Act Articles on record-keeping and human oversight, GDPR accountability and minimisation, NIS2 governance expectations, and eIDAS-qualified attestation paths.
• Implementation and measurable evaluation: A staged implementation plan exists with targets such as p95 enforcement overhead under 5% for automatic decisions, plans to measure audit completeness under faults, verification cost for large logs, and human escalation ergonomics.

Limitations

Main constraints include that MANDATO bounds authority but does not guarantee competence or judgement; the legal characterisation of mandates as delegation requires further scholarly and case-law validation; anchoring is tamper-evident but not tamper-proof within a checkpoint interval and requires trade-offs on co-signing or checkpoint frequency; and the current model focuses on single-authority deployments, leaving multi-proxy composition and cross-domain revocation propagation as open problems.

Implications

Offensive-security implications centre on what a capable adversary could achieve despite MANDATO: a compromised agent can still misuse its granted scope, so overly broad or quota-misconfigured mandates remain a vector for harm; a malicious or colluding operator might attempt suppression between checkpoints, exposing the need for short intervals or co-signing; dependence on QTSPs and key management creates high-value targets for compromise; and unresolved multi-proxy composition questions could be exploited across organisational boundaries. The architecture makes attacks more observable and attributable but does not remove risks where authorised actions are themselves harmful.