Mandate
Mandate firewall
The independent rules that still apply when cover is valid.
The Mandate Firewall enforces transaction caps, periodic allowances, allowlists, time windows, freezing, and revocation.
Rules#
| Rule | What it does | Denial code |
|---|---|---|
transactionCap | Largest single transaction | TX_CAP |
dailyAllowance | Total spend allowed per day | DAILY_ALLOWANCE |
assets | Limits which tokens an agent can touch | ASSET_BLOCKED |
destinations | Restricts an agent to approved contracts and recipients | DESTINATION_BLOCKED |
window | Blocks spending outside the hours an operator allows, in UTC, end hour exclusive | OUTSIDE_WINDOW |
approvalThreshold | Routes transactions above a set size to a person | Outcome is pending |
An agent with no mandate is denied with NO_MANDATE.
Session Key Scoping#
Gives an agent a limited key that only works inside its mandate. A revoked session key is denied with SESSION_REVOKED.
bash
curl -X POST https://dapp.covergate.app/api/v1/agents/<agent id>/session \
-H "content-type: application/json" \
-d '{ "revoked": true }'