Mandat on Nemotron

Give an AI agent a mission, a budget and your rules, as you would a trusted person. NVIDIA Nemotron plans, negotiates and books on Nebius Token Factory; the code enforces every euro.

Comment

Try it in 2 minutes (judges)

  1. Open https://mandat-nebius.onrender.com on a phone or a desktop browser. No sign-up.
  2. Tap Continue with PayPal and log in on the PayPal sandbox page with this test buyer account (sandbox only, no real money):
  3. Type an errand with a budget, for example: Barcelona and Valencia by train, next Friday to Monday, a bed every night and a paella lunch, 250 € max. Or attach a photo of something to fix, or tap the microphone and just talk.

Inspiration

Assistants have become remarkably capable. They answer questions, hold a natural conversation, and many can now take an action when we ask for it: send this, book that, order this one.

But that is not how we delegate to someone we trust. We do not hand over one order at a time. We hand over a mission, a budget and a few rules: "Get me across Spain by train next week. A bed every night, the Alhambra on the way. 650 euros, no more. Small deposits, go ahead; anything bigger, ask me first." Then we stop thinking about it.

No assistant can be given that today. Either it waits for us at every payment, so the errand stays ours, or it would need a card with no real limit and no record of what it did. What is missing is not intelligence. It is a mandate: a budget and rules that still hold on the day the model gets something wrong.

Mandat provides that mandate. And we built it on an open model on purpose, because it raised the question we most wanted answered: can NVIDIA Nemotron, served by Nebius Token Factory, carry a real mission with real (sandbox) money, if the code keeps the books? We did not want to assume the answer, so we measured it.

What changes with Mandat

  • From instructions to a mandate. You state the outcome, the ceiling and how much freedom the agent gets: Careful (asks before every payment), Balanced (pays small deposits alone, asks above your limit) or Autopilot (anything inside the mission budget). Mandat does the rest and comes back only for the decisions that are really yours: a time, money, an address, a booking.
  • Rules that are code, not a prompt. Before PayPal is ever called, each deposit is checked against the mission budget at full price (balances due on site included), your approval threshold, a daily limit across all your missions, and a Stop switch that is read again right before each payment. A new mission cannot push you past your monthly limit. The model can propose anything; it cannot spend outside those rules.
  • Held, not charged. Deposits are PayPal authorizations, captured only when the merchant confirms, voided when plans change, refunded after capture. Every movement lands in a statement you can read.
  • Room for the businesses on the other side. A merchant answers through its own AI agent, whose signed identity Mandat checks before negotiating, or with no AI at all: a one-tap request through a private link (Accept, Other time, Decline). Commerce between agents should not require every corner shop to run a model.
  • A reusable pattern for open models and money. The model proposes, the code decides. With that split, a model with 12B active parameters completes our reference mission correctly, and the benches and guardrails are in the repository for anyone to reuse.

What it does

The mission in our video, step by step:

  1. Sign once. Continue with PayPal saves a PayPal sandbox account as the mandate (Vault v3). You pick the autonomy level.
  2. Say it once. "Spain by train, 24 to 30 October: Paris to Barcelona, then Valencia, Seville and Granada, back to Paris from Madrid. A bed every night and the Alhambra visit. 650 € max." Type it, say it, or attach a photo.
  3. One round of questions. Nemotron says what it understood and asks its key questions together (travelling alone? private room or dorm? what time of day?), with complete answer sets to tap, including You decide. Once you answer, the code requires the next step to be a tool call: it works instead of asking again.
  4. It works on its own. It opens each destination in Mandat's merchant network, compares trains and stays, checks each merchant agent's identity card, negotiates or sends booking requests, and holds deposits. In the run filmed for the video, it verified every merchant, then placed six PayPal sandbox deposits (four train legs, two hostels), each held and then captured when the merchant confirmed.
  5. Your call when it matters. If a merchant offers another departure time than the one you asked for, nothing is booked or paid there until you tap one of the times offered, or Look elsewhere.
  6. Every euro accounted for. A recap card closes the mission. Activity shows every hold, capture, void and refund like a bank statement, with receipts and a dashboard you can question in plain words. Agenda shows every booking, with reminders sent to your phone.

It also works from a photo ("my favourite trainers, the sole is worn through": Gemma 3 27B describes the item and the damage; if no repairer can take it, Mandat compares the closest pairs under your budget and checks their photos before suggesting any), by voice (it answers out loud, in short sentences, while the cards carry the details), and it splits a bill with one PayPal invoice and QR code per friend. In English and French, in any city.

Where the data comes from. Places, ratings and photos on the map come from Google Places and OpenStreetMap, products from Channel3, and every booking runs through Mandat's network of merchant agents, which Nemotron can open for any destination, each with its own catalogue, prices and house rules. All payments use the PayPal sandbox.

How we built it on NVIDIA Nemotron and Nebius Token Factory

Mandat is Node.js and Express with an installable web app. Every model call goes through Token Factory's OpenAI-compatible API: one client, one key, a base URL and a model name per role, streaming and tool calling included.

Role Model on Token Factory Why this one
The agent: a tool-calling loop of 31 tools (search, inspect, verify, negotiate, request, hold, void, refund, move a booking, buy, split, remember, plan) Nemotron 3 Super (120B, 12B active) Fast tool calls: about 1.5 to 4 s per call in our logs, with roughly 12k tokens of instructions.
Every merchant's agent, the replies of demo shops with no AI, and the businesses of each new city Nemotron 3 Super Many short JSON turns, each one inside that merchant's private rules.
The senior planner that reviews the plan whenever it changes, before the first payment after each new message from you, and before a mission is called done Nemotron 3 Ultra (550B, 55B active) Depth where a mistake costs money. On six plans with known flaws, three runs each, Ultra got 18 of 18 right and invented nothing; Super got 16 and invented one problem, for 1.5 s less.
Fallback Ultra and Super for each other A call that times out or fails moves once to the other model; a model that hangs is skipped and checked again in the background, so a mission never freezes.
Photos Gemma 3 27B, same endpoint No Nemotron vision model is served on Token Factory. Gemma reads a printed brand five times and Nemotron keeps the majority spelling, so Mandat never names a brand it did not read.

What Token Factory gave us in practice:

  • No lock-in. Moving the agent to Nemotron was a base URL, a key and a model name; tool_choice: "required" and streamed usage work as expected.
  • Benching instead of guessing. With every model behind one endpoint, the same mission runs end to end on several models (scripts/bench-provider.mjs) and the same plans go through two reviewers (scripts/bench-review.mjs). The roles above come from those runs.
  • A cost we can state. A full birthday mission costs about $0.20 (146 calls over three runs, at list prices, no cache discount counted); Ultra's review adds about $0.02. Input tokens are 88% of that cost, which is why prompt caching is at the top of our feedback.
  • A ceiling on our own bill. Every call's cost is counted from its tokens. Past the demo's budget, no call leaves the server and the app says, in plain words, that the agent is paused, while missions, payments and the agenda stay available.

Around it: the PayPal Server SDK (Vault v3, Orders v2 with authorization, Payments v2) and the PayPal Agent Toolkit for invoices, Google Places and OpenStreetMap, Channel3, Google speech-to-text and text-to-speech, AG Studio for the dashboard, Bryntum Calendar for the agenda, Web Push, Render (Frankfurt) and Cloudflare R2.

Challenges we ran into

We measured before we trusted. scripts/bench-provider.mjs runs the same realistic mission end to end, approves every payment and prints the books. Every failure became a rule in code, with a test that fails without it:

  • Dates. Nemotron sometimes computed "this Saturday" wrong, and the reviewer, with no calendar, once called a correct date a mismatch and pushed the agent to refund a dinner. Now an exact 15-day calendar (weekday and date) is injected at every turn and given to the reviewer.
  • Paying in pieces. A cake deposit was paid as 27 + 21 + 6. Now there is one deposit per booking, and an order that grows becomes a top-up, never a second payment.
  • Saying what was not done. The model once announced a deposit "released" that was not. The rules now allow only what a tool confirmed, and if PayPal does not release a deposit, the agent is told it is still held.
  • Tool arguments. A plan arrived as a JSON string; a phone number appeared that the user never gave. The plan is now parsed tolerantly, and an invented phone number is refused.
  • Asking one question at a time. Opening questions now come together with complete answer sets; once answered, the next call must use a tool. Questions of taste in the middle of the work are decided, not asked.
  • Another time, accepted alone. A restaurant full at 8 pm offered 7 pm and the agent took it. Now any other time blocks every booking and deposit there until the user taps one.
  • A birthday-cake perfume. Asked for a cake, the model searched the product catalogue. Cakes and flowers now always come from a local bakery or florist, delivered to the venue.
  • Thinking out loud. "Wait compute: 296.40 + 50…" reached the screen once. Such a reply, a wrong sum or a reply in the wrong language is now rewritten before anyone reads it.
  • Long trips. On five-city rail trips Nemotron sometimes asked the user to approve a payment card it had never created. Short missions are reliable; long multi-city trips are our next fix: the payment card must come from the plan in code, never only from the model's words.

With these rules, in six runs of our birthday mission on Nemotron 3 Super, the first PayPal deposit was ready for approval 31 to 70 seconds after the request in five runs (99 s in the sixth), and the runs that went to the end closed with three bookings, inside the budget, in three to four minutes.

Accomplishments that we're proud of

  • An open model, on open infrastructure, carrying a mission from one sentence to captured deposits, without ever being the part that decides whether money moves.
  • Each model where it is best: Super for the many fast steps, Ultra where a mistake costs money, a choice backed by a bench rather than by intuition.
  • Nemotron on both sides of the table: the buyer's agent negotiates with merchant agents that defend their own margins, and Nemotron can open a whole merchant city on demand.
  • 18 automated tests that drive the real agent loop against a simulated OpenAI-compatible provider, so the guardrails are checked without spending a token.
  • The demo you can try is the one in the video: the steps shown beside the app are the agent's real event log on Nemotron.

What we learned

  • Give the model facts, not arithmetic. The biggest gains came from injecting exact dates and exact books at every turn, not from longer instructions.
  • Use reasoning depth where errors are expensive. A bigger reviewer on a few calls cost about 10% more and caught every flaw in our bench.
  • For agents, input is the bill. Long, stable instructions dominate the cost of a tool loop, so caching matters more than output price.
  • Trust is a property of the system, not of the model. The same guardrails make any model safer with money.

What's next for Mandat

Next weeks: reliable long trips. The payment card will be created from the plan in code, so a five-city trip can never wait on a card that does not exist. We will run the bench on more missions, and try Nemotron 3 Nano and Nemotron 3.5 Lightning for merchant agents and other short calls, keeping Ultra on review.

Next months: standing mandates on Nebius. Today a mandate covers one mission. Next it becomes a routine with the same rules and the same Stop switch: "keep my train travel under 1,500 € this quarter", "if my train is cancelled, rebook within 30 € more", "book the cleaner every other Friday". Long-running work (merchants answering hours later, reminders, rebooking) fits Nebius Serverless Jobs, and the app itself Nebius Serverless Endpoints. Merchant identity cards would come from a real agent registry instead of our demo authority.

The bigger idea. Today we tell assistants what to do. Tomorrow we will tell them what we want and what they may spend. That only works if people can trust an assistant with their money, and Mandat is that layer of trust: a budget, rules enforced by code, a yes when it matters, and a stop that always works, running on an open model anyone can inspect and measure.

The four judging criteria

Criterion Where to look
Technological implementation Three models with distinct, measured roles on one Token Factory endpoint; a 31-tool loop with streaming, forced tool calls, fallback and health checks; money rules enforced in code before every PayPal call; a hard ceiling on the model bill; 18 tests on a simulated provider; two reproducible benches in the repo.
Design A complete product, not a proof of concept: a mandate signed once, three autonomy levels, one round of questions with tap answers, live steps, a hold-to-approve payment sheet, recap card, Activity statement with receipts and dashboard, Agenda with phone reminders, voice and photo input, English and French, installable on a phone, the model named on screen, and a clear message if the demo's AI budget runs out.
Potential impact A real gap: errands that involve money stay ours because no assistant can be given a budget and rules. For anyone who books and buys for a trip or a household, and for small merchants, who can take part with or without AI. Demonstrated on a live demo with real sandbox holds, captures, voids and refunds.
Quality of the idea Nemotron on both sides of a negotiation; Nemotron opening a whole merchant network for any destination; Ultra as a reviewer chosen by measurement; and the split "the model proposes, the code decides" as a pattern for open models that handle money.

This version

Mandat's first commit is dated 1 October 2026, inside the submission period. This version lives on the nebius branch: 31 commits of its own (35 files, about 1,270 lines added) that move the agent to Nemotron on Token Factory, add Nemotron 3 Ultra as the plan reviewer, the guardrails described above, the model-bill ceiling, the tests on a simulated provider, and the Render deployment.

Built With

Share this project:

Updates

Submission history