Mandates: Delegating Authority

A mandate is the only reason an agent can do anything on Tythe, and the only thing standing between it and a rejected action. It is checked inside the principal’s account before any value moves, on every action, with no exceptions and no discretion. This page is what is in it, what each field stops, and how to work with it.

Ceiling and effective

Every numeric field has two values.

The ceiling is what the principal granted. It never changes unless the principal changes it.
The effective value is what you can actually use right now. It is set by the Intelligence Layer from your Conduct Rating, always at or below the ceiling.

A new agent starts at a conservative fraction of the ceiling and earns its way up through clean conduct. An anomaly steps it down. Nothing can set it above the ceiling, and no single adjustment moves it more than a bounded step. Always read the effective value, not the ceiling. The ceiling is what you might eventually have; the effective value is what the account will accept today.

The fields

Field	What it constrains	What happens if you exceed it
Budget per period	Total spend in a rolling window, and the window’s length	The action is rejected. The window rolls from first use, not from midnight
Maximum per transaction	The largest single action	Rejected. Splitting a payment to get under it will hit the budget and the rate limit instead
Counterparties	An allowlist, a denylist, or open counterparties if permitted	Rejected. Denylisted addresses are refused even under open counterparties
Per-counterparty limit	Spend to any one counterparty in a period	Rejected once the counterparty’s own total is reached, even if budget remains
Rate limit	Actions per window	Rejected until the window rolls
Permitted rails	Which of transfers, x402, venue deposits and withdrawals, credit draw, credit repay, and lend you may use	Rejected. A rail not in your mandate does not exist for you
Credit share	The fraction of the principal’s available Credit Limit you may draw per period, and the longest term you may choose	Rejected. Falls automatically if the principal’s Credit Limit falls
Earn authority	The share of idle balance you may move into venues, and per-venue caps	Rejected beyond the share or a venue’s cap
Lend authority	Whether you may supply or withdraw from the credit market	Rejected if absent
Time window	When the mandate starts and when it expires	Rejected before the start and after the expiry. Expiry is mandatory; there are no perpetual mandates
Escalation threshold	The action size above which the principal must approve	Not rejected: held as a pending approval, and executed only if approved in time
Sub-delegation	Whether you may delegate, and how deep	Rejected if absent or at the depth limit

Rolling periods

Budget and rate windows roll from first use. A daily budget that first spends at 14:00 resets at 14:00 the next day, not at midnight. The remaining budget for the current period is reserved from the principal’s balance, so it cannot be spent out from under you by a withdrawal or by another agent.

Reading your mandate before acting

An agent that checks its mandate first fails fewer actions, and every failed action lowers its Conduct Rating. Before an action, read:

the effective value of the field the action touches, not the ceiling;
the remaining budget in the current period and when it rolls;
whether the counterparty is on the allowlist;
whether the amount crosses the escalation threshold, so you can expect a wait rather than a result;
whether the mandate is close to expiry.

All of it is readable through the developer surface, and all of it is on-chain.

How an action is checked

Every action follows the same path, and it is the same for a transfer, a venue deposit, a credit draw, or opening a payment session.

Submit

The agent signs and submits the action to the principal’s account.

Check

The account resolves the agent, confirms it is bound and active and its principal is not suspended, loads the live mandate, decodes the action, and tests it against every field at its effective value: rail, counterparty, amount, budget remaining, per-counterparty total, rate limit, time window, and where relevant credit share, term, earn authority, or lend authority.

Execute or hold

If it passes and is below the escalation threshold, the account executes it on the permitted rail. If it passes but crosses the threshold, it becomes a pending approval instead. If it fails any check, it is rejected.

Receipt

An executed action emits a receipt recording the agent, the mandate, the rail, the counterparty, the amount, and the revenue tag if it is an inflow. The receipt is what the Conduct Rating is built from.

The check is a single pass with no discretion and no retry logic on Tythe’s side. An action either fits the mandate as submitted or it does not.

What a rejection tells you

A rejection names the field that failed. That is useful information and it should change the next action, not be retried.

Rejection	What to do
Budget exhausted	Wait for the period to roll, or ask the principal to widen the ceiling
Above maximum per transaction	Do not split the payment; it will hit the budget and rate limit instead. Ask for a higher ceiling if the size is genuinely needed
Counterparty not permitted	Ask the principal to allowlist it. If it is denylisted, it will never be permitted
Rate limit	Slow down; the window will roll
Rail not permitted	The capability is not yours. Ask the principal
Credit share or term exceeded	Draw less or shorter, or ask the principal. The share also falls if the principal’s Credit Limit falls
Mandate expired or not yet active	Nothing to do until the principal reissues
Agent frozen, or principal suspended	Nothing to do; this is a compliance state

Rejections are recorded. A pattern of them lowers the Conduct Rating, because an agent that repeatedly probes its limits is indistinguishable from a compromised one. Read the mandate, act inside it, and treat a rejection as a signal to change course.

Changes you will see

Change	Effect on you	Who did it
Effective value rises	More room, up to the ceiling	The Intelligence Layer, from your Conduct Rating
Effective value falls	Less room, immediately	The Intelligence Layer, on an anomaly
Ceiling narrowed	Less room, permanently until changed again	The principal
Ceiling widened	Only by revoking and reissuing; you receive a new mandate	The principal
Hold placed	Every action needs approval until cleared	The Intelligence Layer
Revoked	Nothing validates; sessions close	The principal, compliance, or the Intelligence Layer

A mandate is never widened in place. If your authority increases without a new mandate, it is the effective value rising inside the same ceiling.

Sub-delegation, if permitted

You may issue a sub-mandate to another agent bound to the same principal, if your mandate allows it and you are not at the depth limit. Two rules bind it.

Every field of the sub-mandate must be at or below your effective scope at the moment you delegate, not your ceiling.
The sub-agent spends from your budget. Its actions draw down your counters. Delegation divides authority; it never creates it.

If your mandate is revoked, every sub-mandate beneath it is revoked in the same transaction.

What a mandate cannot be made to do

Permit an action on a rail it does not list.
Exceed the principal’s balance: the sum of live mandates’ effective budgets is reserved against it.
Exceed the principal’s Credit Limit: the sum of live credit shares is bounded, and your draws are checked against what is available at that moment.
Outlive its expiry, or survive revocation.
Be widened by the Intelligence Layer.

Payment sessions

How an agent pays per call on x402.

Conduct Rating

What moves the effective value inside the ceiling.

⌘I

​Ceiling and effective

​The fields

​Rolling periods

​Reading your mandate before acting

​How an action is checked

​What a rejection tells you

​Changes you will see

​Sub-delegation, if permitted

​What a mandate cannot be made to do