A mandate is an artifact, not a setting.

TaskContractV1

The contract binds, in one signed object: the tenant, the actors allowed to act under it, the Guardian and audience it is addressed to, the revision, the steps, their constraints, the budget and its units, the validity window, the policy and manifest in force, and the revocation counter.

• taskId · revision

  Identity and version. An approved contract is never edited in place: any change to a step yields a new revision that has to be reviewed again.

• tenant · guardianId · audience

  Who it belongs to and which single execution point may consume it. One mandate addresses one Guardian.

• actors[]

  Each actor binds an identifier to a key and its thumbprint. A step is claimed by proving possession of that key against a fresh challenge, consumed atomically.

• authority

  Set per operation by the protocol. The caller neither chooses it nor may degrade it within the same request, and an approved mandate never lowers a step's threshold.

• steps[]

  Each step names its canonical operation, its provider, its resource list, the digest of its exact parameters, and carries maxUses fixed at one.

• budget

  Durable and atomic per tenant, task, revision and step. Committed means consumed plus anything reserved whose outcome is pending or uncertain, so one grant cannot reserve twice.

• issuedAt · expiresAt

  The window. After it no new step is sent; there is no grace period and no renewal from inside the task.

• policyVersion · revocationVersion

  The signed local policy in force and the revocation counter. If storage or revocation is unavailable, no new effects go out.

The intersection still applies

effective permission = mandate ∩ grant ∩ signed local policy ∩ adapter constraints ∩ budget ∩ identity ∩ validity and revocation

The cloud never widens the local ceiling. A mandate is one more term in the intersection, never a way around it, and the Guardian enforces all of them before a provider is contacted.

State machine

A task occupies exactly one state, and the ledger records the transition rather than the intent.

• draft
• approved
• running
• paused
• completed
• revoked
• expired

Deliberate exclusions

• No subdelegation. One mandate, one Guardian, one budget; a task cannot hand part of itself to another actor or raise a second execution point.
• No open-ended effects. A step without a canonical operation and a parameter digest is not a step.
• No standing authorization. Every mandate expires, and expiry is not renewable from inside the task.
• What the actor reads — documents, tool output, web content, memory — is input, never authority. It cannot extend the contract.
• The adapter determines the canonical effect and the prestate. An agent's summary, a read-only schema or a destination taken from content is not accepted as truth.

The reader's role

The local reader is explanatory. In this profile an isolated finding, an abstention, a non-evaluation or a partial read does not block, revoke or force additional approvals on an exact effect already approved and permitted. Authority is never raised to compensate for an alert, and it is never lowered because no alert appeared. Identity, signature, budget, precondition and revocation keep failing closed — this is not permission to execute without controls.