The Mandate Has to Cross the Boundary

The first three memos of this chapter kept the mandate inside one business. The Encoded Mandate is enforced by the layer that mediates an agent's calls; the Reach Record is written by that same layer. Both assume the layer exists, which is to say both assume the agent's calls pass through infrastructure its operator controls. In September's market memos, they do not.

From Agentic Commerce to Agentic Markets described supply-side resources — inventory, capacity, logistics — represented by agents that reallocate them, and buyer agents that commit against them. Allocation Becomes Computational specified the state a market must hold for that to work. In that market an agent's calls land on another business's Machine-Readable Interface, and the layer that would enforce the agent's mandate is on the wrong side of the boundary. The operator controls what the agent is permitted to do. The counterparty controls what actually happens when the agent asks. Neither can see the other's half.

This is no longer prospective. OpenAI's GPT-Live-1 is in production taking restaurant reservations and food orders by phone — Yelp is the named customer — and booking appointments for a healthcare operator. Each is an agent, acting for one party, committing state that another party owns — a production case of the commitment landing off the operator's infrastructure, not yet the market the earlier memos specified — and the mandate under which it does so is, today, a sentence in the first party's prompt that the second party never sees.

Counterparty Mandate is the portion of an Encoded Mandate an agent carries across an organisational boundary and presents to another business's Machine-Readable Interface: a machine-readable statement of what the agent is permitted to do at this counterparty — enquire, quote, reserve, commit, spend, and to what limits, on whose authority, and whether that authority is still live — so that the receiving system can enforce a boundary the sending system declared. It is the part of the mandate that has to travel.

The shape the corpus already built, pointed the other way

The Lexicon Was the Point described the Declaration Layer: the semantic layer of machine readability, delivered before an agent reads any content, that tells the agent what this business's vocabulary means. The Machine-Readable Interface is its transactional partner — what the agent may discover, evaluate and transact. Both are things a business declares outward to agents arriving at its door. Both exist because an agent that meets an unexpected structure will resolve the mismatch itself and produce a wrong result; the declaration removes the guess.

The Counterparty Mandate is the same move from the arriving agent's side. The business has declared what its vocabulary means and what may be transacted. The agent has not declared what it is permitted to transact. So the receiving system is in the position the Declaration Layer was built to eliminate: guessing. It can see the agent asking to reserve a hundred hours of line capacity; it cannot see whether the agent's operator authorised reservations, or a hundred hours, or this counterparty. Today it resolves that guess by treating the request as authorised because it arrived. The receiving system has no way to check whether this agent, at this counterparty, for this quantity, is inside the mandate its operator wrote — the same position a mediating layer is in when the mandate is a sentence, now on the other side of the boundary.

Declaration Layer: this is what our words mean. Machine-Readable Interface: this is what you may do here. Counterparty Mandate: this is what I am permitted to do here. The Agentic Market needs all three, and the corpus had built two.

What the receiving system enforces

The point of a Counterparty Mandate is that enforcement moves to the party that can perform it. The sending operator cannot enforce a boundary on a call once it has left their infrastructure. The receiving system can, because the call is asking it to change state, and it can decline. What it needs is a statement it can enforce against.

That statement has the mandate's dimensions, scoped to the counterparty. Actions permitted here, on a ladder the market memos already imply: enquire, quote, reserve, commit. Resources, as limits: quantity, spend, duration, so that a mandate permitting a reservation of ten hours cannot be used to commit a hundred. Identity, resolved: which operator this agent acts for, verifiable by the receiver rather than asserted by the agent. And revocation: whether the mandate is still live, since an agent whose operator withdrew its authority an hour ago should not be able to present a mandate that says otherwise.

Every one of those is enforced at the receiving MRI, on the call, in the same act as the market state is updated. The Reach Record on the sending side records that the agent addressed this counterparty and what it committed. The receiving system's own record shows the mandate it enforced. For the first time the two halves of the boundary have a record on each side, and a commitment made in an Agentic Market has a provenance the market can check.

Where Round-Trip Commit meets the counterparty

Heard Is Not Meant introduced Round-Trip Commit for the case where a spoken command triggers an irreversible action: render the resolved state change back to the Steward and execute only on confirmation. In a market the irreversible action is a commitment against another party's state, and the Counterparty Mandate is what tells the receiving system whether this agent is permitted to make it.

The two rules compose. The Steward's confirmation on the round trip authorises the intent; the Counterparty Mandate carries that authorisation across the boundary in a form the receiver enforces. A reservation taken by phone, in GPT-Live-1's telephony example, is exactly this case: a spoken command, resolved to a commitment, landing on a restaurant's system. The Round-Trip Commit rule asks whether the caller meant it. The Counterparty Mandate asks whether the agent was permitted to do it here at all, and the second question is one only the restaurant's system is positioned to enforce — if it has been told what to enforce.

Why this is not agentic commerce already solved

Stripe's ACP Completes the Agent-Readiness Stack read the payments layer as completing the transactional stack. Payments carry authorisation for one action: pay this amount. The Agentic Market's commitments are wider — reserve capacity, commit inventory, hold a slot, promise a delivery. Authorisation objects for those exist in pieces: delegated-authorisation scopes, signed intents, verifiable credentials, procurement limits, vendor contracts. None of them is specified for an agent committing on an operator's behalf at a counterparty it has never contracted with, with limits and revocation the receiver can check at the moment of the call. The object is under-specified for agent commit, not absent. The Counterparty Mandate is the specification, generalised from spend to every action an agent can commit at a counterparty, and it will be built on the pieces that exist.

The Operator's Verdict

An operator whose agents transact with other businesses is presenting a mandate at every counterparty whether or not one was written. If nothing travels with the agent, the mandate the counterparty enforces is the one it infers — usually that the request is authorised because it arrived — and the operator's agent can commit anything the counterparty's interface accepts, bounded only by the agent's own reading of its instructions.

The check is symmetric. As a sender: for each counterparty, what does your agent present that the receiving system can enforce, and what are its limits. As a receiver: for each arriving agent, what do you enforce beyond the fact that it arrived. If either answer is nothing, the market's commitments are Nominal Containment with two parties to it.

Technology changes what is possible. What the counterparty can enforce determines what the agent can commit.