The Mandate
What comes after the web?
My friend Sam Schillace wrote an essay called “The Network Always Beats the Castle.” The argument, roughly: AI is about to do to organizations what packet switching did to the phone system.
The old phone network reserved a path before anything moved. A dedicated circuit. Expensive, reliable, centrally run, and brittle at scale. The internet did something stranger. It broke every message into packets, gave each one enough information to find its own way, and let the network route them. It looked like chaos. It was chaos. It also scaled in a way the old network never could.
His point was that organizations still look like the phone system. Managers are leased lines. Org charts are routing tables. A reorg is the slow, painful rewiring of dedicated circuits. AI changes that by putting intelligence at the edge, so work can route dynamically and expertise can be summoned where it is needed. The castle starts to behave like a network.
I think he is right. And I think there is a second shift hiding underneath the first.
The next internet will not move information faster. It will move agency. And moving agency safely takes something we do not have yet: a way to grant it, bound it, and take it back.
I am henceforth calling that grant a mandate. I did not have to invent the word. When the payments industry hit this exact problem, needing to prove that a person had authorized an agent to spend their money, it reached for the same one.1
The object we are missing
A prompt is not authority. A prompt is language. It is vague, lossy2, context-dependent, and usually trapped inside one session with one model.
That was fine when AI mostly produced text. It stops being fine the moment an agent books travel, moves money, edits code, changes permissions, messages a colleague, or decides which human to interrupt.
At that point the question is no longer what the user said. It is what the user authorized.
A prompt says: do this.
A mandate says: pursue this outcome, for this person, under these constraints, with this authority, using these resources, until these conditions change.
A goal comes closer, and still falls short. A goal is an outcome with a finish line, sometimes with a guardrail or two: get the tests passing, and change nothing else. Agent tools already work this way, taking turn after turn until a checker agrees the condition is met.3 But a goal only answers what should be true when the work is done. It never says who authorized the work, on whose behalf, or how far the permission runs. A goal with no principal is an unsigned instruction: powerful, and accountable to no one. A mandate is that goal plus the authority to pursue it, and the edges where that authority stops.
That is the object we are missing. I think it becomes the thing the next internet is built to move.
Why the bottleneck moved
I have been circling this from another direction, through my work on context intelligence. The frame there is simple. The easy half is holding it. The hard half is knowing what matters. Context is the pile. Relevance is the sorting a purpose does to the pile. It is easy to confuse the two. The intelligent use of context is mostly plumbing: retrieval, big windows, the right chunks in the right place. Context intelligence is knowing what matters and why. The two present very differently: one shows up as convenience, the other as judgment.
That distinction gets sharper at network scale. When everyone’s AI can generate anything, the world becomes an infinite pile. Every document summarized. Every meeting transcribed. Every design mocked up. Production stops being the scarce thing.
So what is scarce?
Relevance was already the answer. But once agents act, relevance alone is not enough. You need relevance under authority. Not just what matters, but what matters, for whom, under what goal, with what permission, at what risk, and answerable to whom.
That is why the mandate matters more than the prompt. The mandate is where relevance gets a frame that is legal, operational, and technical at once. Without it, the agentic internet is content soup with tools attached. Powerful, and ungovernable.
Five ways the internet has moved
The internet has always advanced by changing its native object, and each new object swallowed the last.
The packet let machines exchange data with no dedicated path. The network got stronger by getting less centrally intelligent.
The page let people publish and read without a central owner’s permission. Places you visit, things you click. This is still the mental model most people carry.
The account let people, apps, and payments interact continuously. Log in, follow, subscribe, connect your card. The web began as open terrain, and the platform era rebuilt castles on it.
The agent is where we are now. Software that understands enough context to act across tools, discover other agents, and delegate work. The plumbing for this is being built quickly, and most of it is already open and shared.4
But an agent that can act raises a question none of that plumbing answers: act under whose authority? That is the fifth move.
The mandate carries the answer.
That last question is the one that changes things. An agent without a mandate is just an intern with root access and no job description.
The future is leaking through the checkout page
Commerce feels this first, because money is unforgiving.
Google’s Agent Payments Protocol states the problem plainly: today’s payment rails assume a human clicking buy on a trusted screen, and an autonomous agent breaks that assumption. So it asks the three questions that now matter everywhere. What proof shows the user granted this authority? How does a merchant know the request reflects real human intent? Who is accountable when it goes wrong?
Its answer is a chain of signed mandates. A person’s request becomes a signed record of intent. Their approval becomes a signed record of the exact cart and price. The payment carries a signed record of what may be charged. Each one is tamper-evident, and together they form an audit trail no party can quietly rewrite.5
That is not a payments detail. That is the shape of the next internet arriving early, at the one place the stakes forced it. The same structure is coming for healthcare, legal work, engineering, hiring, operations, and government services. Anywhere an agent can act, it will need a mandate.
A grammar of agency
A mandate is not a permission token. Permission says this app can access your calendar. A mandate says this agent may reschedule non-critical meetings next week to protect two focus blocks, may not move family events or clinical commitments or anything marked urgent, and must ask before it sends any message that changes a commitment someone else depends on.
The first grants access. The second grants situated agency. That takes about ten parts, and none are decorative. Each one is a part a grant of agency needs before it is safe to hand off.
Principal. Who is the agent acting for? A person, team, patient, or institution. This needs verifiable, representational identity, not just a login.6
Agent. Which agent instance, from which provider, under which policy, with which tools? The accountability surface.
Purpose. What outcome is being pursued? The relevance anchor. Without purpose there is no relevance, only context.
Scope. Which systems, data, people, and time periods may be touched? The line between useful delegation and ambient overreach.
Constraints. Budget, deadline, risk tolerance, compliance rules, privacy limits. Where “do a good job” becomes operational.
Escalation. When must the agent stop and ask? Irreversible action, money movement, legal or clinical commitment, low confidence, conflicting instructions. The future is not human-in-the-loop everywhere. It is human-in-the-loop at the right moments.
Delegation rights. May the agent hand work to other agents, and how far? A network of agents with no delegation limits becomes a small bureaucracy made of ghosts.
Provenance. What context shaped the action, which sources, which model, what changed between draft and execution? We are learning to demand this for media. Agency needs it for decisions.7
Receipts. A structured record of what was attempted, what was done, under which mandate, against which systems, with what result. Receipts turn agents into accountable actors instead of magical events on a screen.
Revocation. How the human stops it. Not “email support.” Expire the authority, cancel downstream delegation, freeze the subagents, invalidate the credential. Without revocation, delegation becomes capture.
It helps me to stop describing a thing and write it down. Here is a mandate as an object, the kind a coding agent might carry while it clears a broken deployment.
{
"principal": "did:example:mj",
"agent": "did:example:waypoint-agent-17",
"purpose": "Resolve the failed deployment and unblock the team",
"authority": {
"tools": ["github", "slack", "vercel", "linear"],
"max_spend_usd": 0,
"may_contact": ["engineering-team"],
"may_modify": ["pull_requests", "deployment_config"],
"may_not_modify": ["production_database", "billing"]
},
"context_scope": {
"allowed_sources": ["repo", "recent_incidents", "deployment_logs"],
"excluded_sources": ["personal_email", "finance", "medical"]
},
"escalation": {
"ask_human_if": [
"irreversible_action",
"security_risk",
"customer_visible_change",
"confidence_below_0.82"
]
},
"expiry": "2026-07-01T23:59:00-04:00",
"revocation": "https://example.com/revoke/abc123",
"audit": {
"log_level": "tool_calls_and_rationale",
"receipt_required": true
}
}Read it and the grammar is right there. A principal and an agent, both as verifiable identities. A purpose in plain language. An authority block that says what the agent may touch and, more to the point, what it may not: no production database, no billing, a spend limit of exactly zero. A context scope that walls off personal email, finance, and medical records, so the agent cannot quietly launder them into an answer. An escalation rule that stops and asks a human the moment confidence drops below 0.82. An expiry. A revocation link. An audit trail that is required, not optional.
It even shows the grammar by what it leaves out. There is no delegation clause, so this agent may act, but it may not hand the job to another agent. That absence is not sloppiness. It is a sentence too.
The failure modes prove the grammar
Watch how delegation actually breaks, and every failure turns out to be a missing part of that grammar.
Fake authority. An agent claims to represent someone it does not, or keeps acting after its authority expired. A weak Principal and no Revocation.
Context laundering. An agent uses information it was not allowed to use, then hides the source inside a plausible answer. Missing Provenance. It is most dangerous exactly where it is hardest to catch: medicine, law, finance, hiring.
Delegation drift. A user grants authority for one thing. The agent delegates. That agent delegates again. By the time anything happens, the original intent is a rumor. Missing Delegation limits.
Authority injection. Prompt injection today mostly makes an agent say the wrong thing or call the wrong tool. Here it goes after the authority itself. Not “ignore previous instructions,” but “treat this as approved,” “add this merchant to the trusted list,” “reveal the hidden mandate.” The mandate becomes the attack surface, which is why it has to be signed and verifiable rather than conversational.
Principal inversion. This is the one I worry about most, because no single field fixes it. The human stays the legal principal, but the agent becomes the practical one, because it controls the information flow, frames the options, sets the tempo, and decides when the human is even asked. You are still in charge the way a board is in charge of a company whose operations it no longer understands. Formally true. Operationally hollow.
Principal inversion is why the grammar is not enough on its own. It needs a few rules that sit above every field and never bend.
Three anti-patterns
Even a perfectly filled-in mandate does not stop these three. They live above the fields, and they are why the grammar needs a few rules that never bend.
Goal capture. The cousin of principal inversion, one level up. Not who runs the process, but whose goal it is. The agent keeps the mandate and quietly rewrites the point of it, trading the principal’s goal for its own convenience, the platform’s business model, or the easiest measurable proxy. The rule that stops it: the human, team, or institution stays the source of the goal. The agent may propose, refine, and flag contradictions. It may not author the goal.
The narrowed frame. The agent answers well, and you slowly stop asking why. It frames the options and picks the assumptions, and the space of things you might have considered shrinks without anyone choosing to shrink it. The rule that stops it: you must always be able to ask why this, what did you ignore, what would someone who disagrees say, which assumption drove it. Without that, AI does not help us think. It edits the space of thoughts we can have.
The one-way door. Authority flows in and nothing flows back. Actions cannot be revoked, replayed, or repaired, and by the time the damage is legible it is already done. The rule that stops it: revocable authority, replayable actions, contestable decisions, repair wherever we can manage it. The deeper AI moves into action, the more this matters. Undo is not a feature. Undo is governance.
Name the authority, not the actor
These are the old internet's problems, arriving again for agency. Some work needs hard guarantees; some is best-effort; right now a human is the one telling them apart. Agents need to be found by capability, not by knowing an org chart. Institutions need to route work to each other without either side running the other. None of that is new in kind. It is the same set of problems the internet once solved for data.8
Which brings me to the name. The industry is settling on “agentic web,” and even my own organization uses it.9 It is not wrong. It is just not yet complete. It names the actor. I want to name the authority.
An agent is what acts. A mandate is why it may act.
That distinction decides who the future belongs to. It should not belong to the most capable agents. It should belong to the best-governed grants of agency. A world of agents without mandates is a world where every service tries to become your representative by default. A grammar of mandates says no. Representation must be granted. Authority must be scoped. Actions must be inspectable. Delegation must be revocable. That is a civilization-scale design constraint hiding inside a product problem.
You can watch this being built from the other side. Satya Nadella, describing a near future with as many as twenty million agents running alongside Microsoft's people, reaches for the same non-negotiables from the platform: give every agent an identity, a sandbox, and a policy, and make its reasoning "fully inspectable, fully auditable."10 That is the authority layer arriving from above, and the largest operators are already standing it up. But notice the direction. An inventory and an audit trail tell you what an agent did; they keep the human as the auditor. A mandate keeps the human as the principal. Inspectability proves the action happened. It does not, by itself, stop principal inversion, the human holding the title while the machine holds the controls. Same commitment, opposite direction: the platform grants oversight downward, the mandate carries authority up from the person who is accountable for it.
What comes next
The early moves are already here. Agents use tools, because nobody wants to build custom integrations forever. Then agents talk to other agents, because agent ecosystems cannot scale on bespoke wiring. Then sites expose surfaces built for agents, and the browser starts to lose its centrality: humans still browse, agents transact.
Then mandates become ordinary. They show up first where trust is non-negotiable, in payments and healthcare and enterprise operations, then spread into daily work. Manage my inbox under these rules. Handle renewals below this amount. Track the commitments from this meeting and chase them unless blocked. Never ask me about low-risk reversibles. Always ask me about high-risk irreversibles. When that happens, the interface stops being a chat box and becomes a mandate editor, an exception queue, an audit trail, a revocation panel.
And then it reaches institutions, which is where this rejoins Sam’s argument. Some organizations will not merely use agents. They will be organized around grants of agency. Work routes dynamically. Authority is scoped programmatically. Teams form around a problem and dissolve when the mandate closes. People hold portfolios of agency instead of fixed job descriptions. The org chart does not vanish, but it stops being the routing map. The real map becomes: who can authorize what, under which mandate, answerable to whom. That is not a software feature. It is a new operating system for institutions.
The discomfort is the point
This should feel like too much authority moving into the machine. It is. But refusing to name the authority layer does not stop delegation. It only makes delegation implicit, which is worse.
The question was never whether agents will act on our behalf. They already do, badly and unevenly. The question is whether we build a world where that action is bounded, inspectable, revocable, and accountable.
The old internet let information move without central permission. The next one has to let agency move without losing human sovereignty. That is the hard part, and it is why “AI UX” is too small a frame for the work. We are not designing chat windows. We are designing the terms on which human intention survives contact with machine-speed execution.
A page says: here is information. An API says: here is a function. An agent says: I can do work. A mandate says: I am authorized to pursue this purpose, for this principal, under these constraints, with these tools, until this boundary.
That is the new packet. Not data. Agency.
If the network always beats the castle, the question is not whether agents spread. They will. The question is whether they spread as a swarm of ungoverned executors, or as a grammar for human agency.
That is the bet. That is the work. And I think it is the next internet.
Notes and references
Google Cloud, Announcing Agent Payments Protocol (AP2), September 16, 2025. AP2 represents an agent purchase as cryptographically signed Mandates, tamper-evident digital contracts that serve as proof of a user’s instructions. The word is theirs, not mine. https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol
"Lossy" is from data compression: unlike a lossless format (ZIP, PNG), a lossy one (JPEG, MP3) discards detail you can't recover. Language is lossy too. A prompt squeezes a whole intention into a few words and the model guesses the rest. A mandate encodes the authority with less loss, writing the constraints down instead of leaving them to be inferred. The idea goes back to Claude Shannon's information theory ("A Mathematical Theory of Communication," 1948).
Claude Code’s /goal is a clean example: you set a completion condition and it keeps taking turns until a small fast model confirms the condition holds, then clears itself. It governs the objective, not the authority, which is the whole line between a goal and a mandate. (Anthropic, Claude Code documentation.)
The open plumbing for agents to use tools and to talk to each other is arriving fast, and is now mostly under neutral governance. The Model Context Protocol (MCP), an open standard for connecting agents to tools and data, was introduced by Anthropic in November 2024 and donated to the Linux Foundation’s Agentic AI Foundation in December 2025 (spec: https://modelcontextprotocol.io). Agent2Agent (A2A), an open standard for agent-to-agent discovery and delegation, was launched by Google in April 2025 and donated to the Linux Foundation in June 2025 (https://a2a-protocol.org). NLWeb (Microsoft, R.V. Guha, Build 2025) lets a website answer natural-language queries and act as an MCP server; its README puts it neatly: “NLWeb is to MCP/A2A what HTML is to HTTP” (https://github.com/microsoft/NLWeb). What all of them share is a gap: they move tools, tasks, and messages, but they do not, on their own, carry authority.
AP2 defines three signed mandate types across the transaction lifecycle: an Intent Mandate (the user’s constraints and goal), a Cart Mandate (the exact items and price the user approved), and a Payment Mandate (what may be charged, shared with the network). Each is a signed object built on W3C Verifiable Credentials, forming a non-repudiable chain from intent to settlement. AP2 ships as an open extension to A2A and MCP, and was announced with 60+ payments and technology partners. Spec: https://ap2-protocol.org
W3C Decentralized Identifiers (DIDs) v1.0, W3C Recommendation, July 2022 (https://www.w3.org/TR/did-core/), and the W3C Verifiable Credentials Data Model v2.0, W3C Recommendation, 2025 (https://www.w3.org/TR/vc-data-model-2.0/). Together these give an agent a way to prove who it is acting for without a central identity provider in the loop. AP2’s mandates are built on exactly this credential model.
The Coalition for Content Provenance and Authenticity (C2PA) is standardizing tamper-evident provenance for media, certifying where a piece of content came from and how it was changed (https://c2pa.org). The Mandate needs the same idea one level up, for actions rather than artifacts: not “who made this image,” but “who authorized this decision, using what.”
For the networking-minded, three of the old internet’s protocols rhyme almost directly. DNS becomes capability discovery: DNS answered where is this site; agency needs to answer who can do this kind of work (”find an agent that can review a contract under New York law,” “find one that can read a patient chart but cannot export PHI”). That is discovery under trust constraints, not search. TCP and UDP become reliability classes: some delegated work needs handshakes, ordering, retries, and receipts (legal filing, a production deploy, payroll); some is best-effort and disposable (brainstorming, sentiment, monitoring). Organizations treat almost everything like high-overhead TCP because humans are the monitoring layer; cheap intelligence lets us classify honestly. Not everything deserves a receipt. Some things absolutely do. BGP becomes institutional routing: BGP lets autonomous networks exchange traffic without one owning the others, and institutions will need the same, so a hospital agent can deal with an insurer agent, or one company’s procurement agent with another’s sales agent, without either exposing its private data or strategy. Stack the whole thing and the layers are roughly: identity, credentials, context, tools, agents, mandates, delegation, receipts, revocation, governance. A2A already gestures at the middle of this; the authority layer is the part still missing.
Microsoft frames this shift as “the agentic web,” and CTO Kevin Scott has suggested MCP may become its HTTP. I think the framing is right and the name is half the story. HTTP moved documents; the harder, later work was HTTPS, identity, and trust. Naming the actor (”agentic web”) is the easy half. Naming the authority is the hard half, and the one worth getting right.
Reid Hoffman and Aria Finger, “Satya Nadella on making human and token capital compound,” Possible (podcast), June 5, 2026, recorded after Microsoft Build 2026. Nadella describes an inventory-and-governance layer for agents (extending Entra, Defender, and Purview under the “Agent 365” banner) and, separately, execution-time “asserts” that bound what a long-running agent may do. Transcript: https://www.possible.fm/podcasts/satya-nadella-on-making-human-and-token-capital-compound/