Gates, not dates.
Everything below is checkable. Shipped work is dated and links to the thing itself. Committed work names the public condition that releases it, never a quarter — a review that has or has not happened, a schema somebody else has or has not published. Where we have not decided, it says so.
A date is a forecast, and a forecast on a page like this is unfalsifiable until it is already wrong. A gate can be checked today, by you, without asking us.
Where this stands today
mnd8t is a sandbox developer preview and not yet a production service. It does not support use with real funds, and its terms do not permit it. Read everything below on that footing.
- Author, version, publish and revoke mandates
- Run in shadow mode against real traffic and compare decisions
- Run in enforce mode against a simulated wallet or an EVM testnet
- Deterministic APPROVE / REJECT / ESCALATE with full reason sets
- Human approval links and the approvals dashboard
- Signed, independently verifiable evidence receipts
- Verify whether a mandate's objective was fulfilled, against evidence you supply
- Use with real funds — unsupported, and not permitted by the terms
- Production SLAs, load-tested throughput, capacity guarantees
- Any mainnet or bank-rail adapter
- Compliance screening of any kind (KYC, AML, sanctions)
- Approval emails by default — configure a provider
- Enterprise SSO, billing, a mobile app, self-service org invites
- Evidence mnd8t fetches or checks itself — no carrier, merchant or ERP integrations
The full account, including what this makes you responsible for, is in known limitations.
Shipped
Dated from the commit that introduced each one, newest first, every entry linking to the thing itself. A roadmap that shows its past is checkable in a way one that only shows its future is not.
- 16 October 2026shipped
One mandate for several agents, with a shared budget
A mandate can be granted to up to 20 agents. They draw on one daily and monthly budget, locked per decision so no race between them can exceed it, whether a decision is executed through an authorisation artifact or projected as an AP2 mandate. Revoking the mandate stops them all; suspending one agent stops only that agent. Built ahead of a design partner, as the reference demonstration of continuing delegation.
- 4 October 2026shipped
AP2 adapter v0.1, behind a flag
One approved decision can be projected as single-use AP2 Open Payment Mandate content for the customer to sign, spending the decision's authorisation so it cannot pay twice. The SDK checks a closed AP2 payment against the decision's Authority Record. Off by default; standing AP2 mandates with budgets are not produced.
- 2 October 2026shipped
Authority Record v0.1: verifiable by anyone, bound to the action
Every decision's signed record now carries a digest of the exact action, with published test vectors, and anyone can verify a presented record without a credential. Verification reports the signature, the record's integrity and whether it matches the action apart from whether the mandate still stands, and records signed before a key rotation stay verifiable.
- 1 October 2026shipped
Identity attestations as an input to authority
An admission protocol such as AFSP establishes who an agent is, who it acts for and that the session was authorised. That attestation can now accompany each decision. It is recorded in the Authority Record beside the mandate, never inside it, and a mandate can require one. It can refuse an action but never widen authority.
- 12 September 2026shipped
Outcome verification
A mandate can now record what it was for, not only what it permits, and that objective is evaluated against evidence after execution. Authorisation and objective evaluation are separate results that are allowed to disagree; objective evaluation uses customer-asserted evidence.
- 8 September 2026shipped
The intelligence hub and the Agentic Authority Stack
A public reference on delegated financial authority: a dated tracker, the authority landscape, an infrastructure map, comparison tables and a glossary, each claim cited primary-first.
- 5 September 2026shipped
Simulations
Nine payment cases played out against a versioned mandate, run through the real decision engine in the browser — including the ones that reject, escalate, and refuse an agent trying to raise its own limits.
- 29 August 2026shipped
Scoped API keys
A key now does exactly what its scopes permit. The AGENT preset carries nothing that can change what the agent is permitted to do — before this, an agent's own credential could add a counterparty and publish a mandate, so the control model was circular.
- 29 August 2026shipped
Asset-denominated limits and asserted valuations
Every monetary rule is evaluated against a policy amount somebody supplies, so whoever supplies it decides whether the limits bind. Limits can now be denominated in the asset itself, and a mandate can require the valuation to come from a credential the agent does not hold.
- 29 August 2026shipped
Reconciliation states
A claimed authorisation whose outcome nobody reported keeps its budget held rather than releasing it on a timer. Reporting spend that happened as spend that did not is the more dangerous error.
- 2 August 2026shipped
The authority boundary (CR-001)
Server-side execution was removed before any external pilot. mnd8t decides and proves; the customer or their regulated provider executes, holding credentials mnd8t never sees.
Committed, and what releases it
Short on purpose. A long committed list is a forecast wearing a commitment's clothes. Each gate below is public: you can check where it stands without asking us, and the status line is written so that it becomes wrong if the gate moves.
Authority enforcement for customer-executed live transactions
Enforcement against real funds, executed by the customer or their regulated provider, rather than against a simulated account or a testnet. mnd8t still does not execute.
- Gate
- The security review checklist in SECURITY.md, plus an explicit approval entry in the architecture decision log. Both are public; neither is a date.
- Status
- Not passed, and no approval entry exists in the decision log. Until it is, the terms prohibit use with real funds. mnd8t cannot detect such use, because the customer's executor moves the money.
AP2 and external mandate schema mapping
Mapping mnd8t's authorisation artifacts and evidence receipts into emerging interchange formats, so authority travels with the payment.
- Gate
- Published draft schemas. Mapping to a moving target would couple the evidence model to something that has not settled, so the condition is somebody else's publication.
- Status
- Gate met: AP2 v0.2 has published its schemas. Adapter v0.1 is built behind ENABLE_AP2_MAPPING, off by default. It projects one approved decision as single-use AP2 Open Payment Mandate content and checks a closed AP2 payment against the decision's Authority Record. Standing AP2 mandates with budgets are next, and wait on mnd8t holding the budget an AP2 mandate can spend.
Native verification of AFSP attestations
Identity and session attestations from admission protocols such as AFSP are already accepted on each decision, recorded in the Authority Record beside the mandate, and checked against the mandate's requirements for issuer, protocol, validity and agent. Their signatures are not yet verified by mnd8t.
- Gate
- A published AFSP protocol binding: transport, endpoints, message formats and platform key discovery. The v0.1 draft defers these to later versions, and verifying against a format that does not exist yet would bake a guess into the evidence model.
- Status
- Recording and rule checks shipped. Every recorded attestation is marked PRESENTED_UNVERIFIED until verification lands.
Longer budget windows and per-supplier limits
Aggregate limits beyond a calendar month, such as a quarter or the life of the mandate, and limits per supplier, held on the same locked ledger that several agents already share. Today budgets are per transaction, daily and monthly.
- Gate
- A design partner running a recurring workflow that needs a window or a supplier limit the daily and monthly budgets cannot express, because the ledger's shape should follow a real workload rather than a guessed one.
- Status
- Not started. Shared budgets across agents ship on the daily and monthly ledger; no other window or per-supplier ledger exists.
Approval emails sent by default
Today an escalation's approval link appears in the dashboard and in server logs unless you configure an email provider yourself.
- Gate
- Choosing an email sub-processor and publishing it in the sub-processor list, because sending on your behalf adds a party to your data path.
- Status
- Not started. No email provider appears in the sub-processor list.
Wallet adapters beyond the simulated account and one EVM testnet
Additional providers and rails, connected through the adapter interface that already exists.
- Gate
- A design partner operating on that rail. Building adapters nobody has asked for is how a control layer turns into an integrations company.
- Status
- Open. The interface is stable; the queue is empty.
Open questions
Published as open. These are not softened commitments — when one is settled it moves up into the committed list with a gate, or down into the list below with a reason.
Does outcome verification belong in the headline proposition?
The headline is now the authority layer for agentic finance: one delegation, applied wherever an agent acts, with every decision verifiable. Outcome verification sits inside Prove, as the start of an evidence model that can extend from authorised to executed, accepted, fulfilled, refunded or disputed wherever execution systems supply trusted evidence. It is not a claim that mnd8t verifies delivery. It may deserve to move up. It may also be the thing that makes the product hard to explain.
Settled by Whether teams evaluating mnd8t arrive asking whether an agent was entitled to act, or asking whether what it did achieved anything.
Should one agent be able to hold several concurrent mandates?
Decisions resolve against one mandate per agent today. Several concurrent mandates would let one agent hold different authority for different purposes — and would make it materially harder to answer what an agent may do right now, which is the question the product exists to answer.
Settled by A design partner with a real workload the single-mandate model cannot express.
How does an execution system show it can enforce what a decision requires?
A decision can carry requirements beyond its amount: a counterparty, single use, a deadline, an approval state. A rail that cannot enforce one of them should not receive the action, so changing route cannot quietly weaken the mandate. Today the single-use authorisation artifact carries amount, counterparty, destination and expiry, and the AP2 projection refuses what it cannot express. There is no general way for an adapter to declare what it enforces, and no agreed set of assurance levels.
Settled by Two execution environments wired to the same mandate, and a set of assurance levels whose claims can be checked rather than asserted by the adapter that makes them.
Can outcome evidence ever be more than customer-asserted?
Evidence is supplied by you and nothing checks it, which is a real limit on what an outcome record proves. Fetching it ourselves would make mnd8t an observer of transactions it deliberately does not execute, and that is the boundary the whole architecture is built on.
Settled by Finding a form of verification that does not put mnd8t back inside the perimeter CR-001 took it out of. We do not have one.
What mnd8t will not build
These are not gaps waiting to be filled — they define the service, and they belong on the roadmap rather than in a footnote. Each one is a boundary that makes the rest of the product possible to reason about.
Your execution credentials never reach mnd8t. A control layer that also holds the keys is not a control layer.
mnd8t selects no asset, counterparty, venue, exchange rate or execution time. Doing so would pull dealing and arranging into the perimeter.
Counterparty status records your assertion about who you authorise paying. External check results are stored exactly as supplied and verified by nobody here.
You supply the amount already normalised, with provenance. Fetching rates would make mnd8t a valuation party.
A decision that cannot be replayed to the same answer is not an authority decision. This one is permanent.
Settlement is fragmenting and that is fine; authority should not fragment with it. mnd8t sits above whatever rail executes.
Outcome verification proves a conceptual model. Wiring it to logistics would turn an authority layer into a fulfilment product.
Every rule the engine evaluates must be enumerable and testable. Arbitrary code is neither.
Evidence receipts prove what was decided and on whose authority. Whether that satisfies a given regulation is a question for your advisers.
Last reviewed 21 October 2026. This page carries no delivery dates by design. If something here is out of date, that is a defect — hello@mnd8t.com.