Agent Mandates and the EU AI Act: Authority Your Agents Can Prove

Scoped, expiring, revocable authority for AI agents as W3C Verifiable Credentials — plus a disclosure engine that enforces EU AI Act Article 50 per channel and per language.

Mandates

Before an agent sends its first message, a named human grants a mandate to a specific API key. Mandates are W3C Verifiable Credentials, and they are:

The disclosure engine

EU AI Act Article 50 requires that people are told when they are interacting with an AI system. In practice that is harder than appending a sentence:

Risk scoring and human approval

Drafts are risk-scored before delivery. Anything over your threshold diverts to a human approver instead of going out. The approver's decision — approve or reject, with identity and timestamp — is itself signed and appended to the ledger.

Where to start

Publish a policy version with your disclosure and risk settingsIssue a mandate to the API key your agent usesSend, and check the attestation badge in the inbox

Kanvo Team

Writes here about what Kanvo is building and why — the send path, the evidence it leaves, and the decisions behind both.

Related Articles

The AI Act's transparency rules became enforceable in August. A disclosure has to survive a 160-character text message, a language you don't speak, and a platform that strips formatting — here's how Kanvo makes that automatic, and refuses the send when it can't.

Every AI-Sent Message Into the EU Now Needs a Disclosure. Most Channels Can't Physically Carry One

The AI Act's transparency rules became enforceable in August. A disclosure has to survive a 160-character text message, a language you don't speak, and a platform that strips formatting — here's how Kanvo makes that automatic, and refuses the send when it can't.

Enjoyed this article?

Subscribe to our newsletter for more insights and updates.