TrueMandate

• 

  System Architecture

• 

  TrueMandate Governed Lifecycle Sequence

Inspiration

AI agents are becoming capable of taking real world actions: purchasing goods, booking travel, paying invoices, managing SaaS spend, and interacting with external systems.

But this creates a fundamental trust problem:

How do we make sure an AI agent can only do exactly what the user authorized?

Today, a user's intent is often expressed in natural language, while an executable action requires concrete parameters such as scope, economics, workflow, expiry, and the exact action to be performed. The dangerous assumption is that an agent can safely translate between the two.

TrueMandate was built around a different principle:

The agent should never become the source of authority.

Instead, user intent is transformed into a verifiable, bounded mandate whose authority can be checked throughout the entire lifecycle.

What it does

TrueMandate provides a governed authorization lifecycle for agentic actions across Procurement, Travel, SaaS / IT Spend, Invoice / Vendor Payment, and Logistics / Fulfillment.

The core lifecycle is:

Raw Intent → Compile / Verify → IntentState → Plan / Guardian → Authority → Prepare → Authorize → Commit → Controlled Mock Execution → Outcome Contract

Each stage preserves the lineage of the user's finalized intent.

Before an action becomes executable, TrueMandate verifies that:

• The requested action matches the authorized intent • The scope has not been broadened • The economics have not changed • The workflow requirements are satisfied • The mandate has not expired or become stale • The canonical state and hashes still match • The authorization being executed corresponds to the exact verified state that produced it

The system is designed to fail closed. If the requested action no longer matches the mandate, TrueMandate stops rather than guessing, widening permissions, or silently accepting the change.

The live demonstration uses controlled mock execution rather than real financial settlement, allowing us to demonstrate the complete governance lifecycle safely.

How we built it

TrueMandate is implemented as a TypeScript monorepo with separated domain packages and independently deployed Cloud Run services.

The architecture uses:

• TypeScript for the core domain, protocol, and service implementation • Cloud Run for independently deployed services • Firestore for durable repositories, transactional state, and authorization records • Pub/Sub for governance events with application level deduplication • Vertex AI Gemini (gemini-3.7-flash) to propose semantic objects; deterministic infrastructure validates authority and execution boundaries • Google ADK and A2A for agent orchestration and interoperability, without granting either authority to execute privileged actions • Model Armor to defend against prompt injection in untrusted external content • Zod for strict runtime validation of external and model generated payloads • Canonical hashing for deterministic state identity • Reference bound authorization to preserve lineage between stages • A five judge Semantic Guardian that must clear before authority is granted • A two phase Gateway: PREPARE → AUTHORIZE → COMMIT, with single use commit tokens, expiry checks, and idempotency • Provenance records and Outcome Contracts to explain decisions and distinguish action completion from real world outcome success

A major design decision was to make authorization lineage explicit.

Instead of allowing services, agents, or models to implicitly trust one another, every executable authorization is tied back to the exact verified state that produced it. References remain owner held, while canonical hashes provide deterministic identity for the state being authorized.

The Semantic Guardian provides an additional semantic verification layer before authority is granted. Multiple independent judges evaluate whether the proposed action remains consistent with the user's mandate rather than allowing a single model decision to become authorization.

The Gateway then enforces the reference bound PREPARE → AUTHORIZE → COMMIT lifecycle. Commit tokens are single use, bounded by expiry, and protected through idempotency controls.

The live demo performs controlled mock execution, producing provenance records and an Outcome Contract that captures what the system authorized, what it executed, and whether the expected outcome was actually achieved.

This architecture deliberately separates semantic intelligence from deterministic authority. Models can interpret intent and propose actions, but they cannot grant themselves permission to execute privileged operations.

Challenges we ran into

The hardest challenge was designing authorization as a stateful lifecycle rather than a single permission check.

We had to make sure that every transition could be independently verified without allowing substitutions, stale state, or silent privilege expansion.

Concurrency and persistence introduced another layer of complexity. Create once guarantees, deterministic hashes, exact lineage, stale state detection, and fail closed behavior all had to work together.

Another challenge was keeping the system honest about what it actually proves.

Rather than claiming that TrueMandate already performs production financial settlement safely, we deliberately use controlled mock execution in the live workflow. This allowed us to demonstrate the governed authorization lifecycle, controlled execution, and outcome recording without pretending that production financial settlement has already been solved.

Accomplishments that we're proud of

We are proud that TrueMandate turns an abstract security principle into a concrete, verifiable authorization lifecycle.

Instead of simply saying that an agent should respect user permissions, the system makes that requirement enforceable through state, lineage, canonical identity, and bounded authority.

We are particularly proud of:

• Building the authorization lifecycle end to end • Preserving intent lineage across multiple service boundaries • Implementing deterministic canonical state and hashing • Handling stale state and concurrency concerns • Designing the system to fail closed instead of recovering through broader permissions • Implementing the reference bound PREPARE → AUTHORIZE → COMMIT flow • Demonstrating controlled execution and outcome recording across multiple real world action domains

Most importantly, the prototype demonstrates a different trust model for agentic systems:

The agent can propose and act, but the authority to act comes from the mandate, not from the agent.

What we learned

The biggest lesson was that authorization is not simply authentication plus a permission check.

An agent can be correctly authenticated and still perform an action the user never intended.

For agentic systems, authorization has to preserve intent across the entire execution lifecycle.

We also learned that security properties cannot depend solely on prompts or application level assumptions. They need to be represented in the architecture itself through explicit state, deterministic identity, lineage, bounded authority, and fail closed transitions.

Most importantly, we learned that the difficult part of agentic authorization is not deciding whether an action looks reasonable.

It is proving that the action being executed is the same action the user actually authorized.

What's next for TrueMandate

The current implementation establishes the governance and authorization foundation. The next step is to move from controlled mock execution toward real integrations while preserving the same authorization guarantees.

Future work includes:

• Real payment and financial settlement integrations • Deeper integrations with procurement, travel, SaaS, invoice, and logistics platforms • More sophisticated policy and Guardian evaluation • Human approval and escalation workflows • Stronger cryptographic attestation of authorization state • Richer Outcome Contracts and post execution verification • External audit and compliance capabilities • Production grade execution safeguards and recovery mechanisms

The long term vision is to make verifiable, bounded authority a standard layer between AI agents and real world actions.

Agents will become increasingly capable of acting on our behalf.

TrueMandate is about making sure that capability never becomes authority.

Built With

• css
• docker
• firestore
• gemini
• google-cloud
• hcl
• html
• javascript
• node.js
• pub/sub
• react
• shell
• terraform
• typescript
• vite
• vitest
• zod