Preview a mandate, then apply it
Compile a mandate with apply: false, read the grants it would make and its previewDigest, then apply exactly what you previewed.
mandates.compile
Compile a mandate with apply: false, read the grants it would make and its previewDigest, then apply exactly what you previewed.
mandates.compilePut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
A mandate is an agent's charter as code, and applying it changes what Intralock admits at once. You want to read the grants first, and you want the apply to fail if the mandate or the constitution moved after you looked. The preview digest binds the two.
policies.approve the narrowest permission the doc names for this steppolicies.approve permission, for the apply stepimd, Cedar or Rego (an equality subset)The code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Send the source with apply set to false. The mandate compiles to grants and the signed artifact is stored, but the workspace snapshot does not change. simulate is the read-only twin that returns the diff against the constitution in force.
revoked and withheld lists, so you can read the effect.mandates.compilemandates-compile
curl -sS -X POST https://api.intramedial.com/api/v1/acp/mandates/compile \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"source": "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
"format": "imd",
"apply": false
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/mandates/compile", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
source: "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
format: "imd",
apply: false,
}),
});
const body = await res.json();
console.log(body.mandate.grants, body.applied, body.previewDigest);import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/mandates/compile",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"source": "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
"format": "imd",
"apply": False,
},
timeout=30,
)
body = res.json()
print(body["mandate"]["grants"], body["applied"], body["previewDigest"])Read mandate.grants and keep previewDigest. It covers the compiled grants and the constitution, not the source text.
Send the same source with previewDigest. If the mandate or the constitution moved since, the call is refused with 409.
curl -sS -X POST https://api.intramedial.com/api/v1/acp/mandates/compile \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"source": "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
"format": "imd",
"previewDigest": "9c1e5a07d4b3"
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/mandates/compile", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
source: "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
format: "imd",
previewDigest: "9c1e5a07d4b3",
}),
});
console.log(res.status, await res.json());import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/mandates/compile",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"source": "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing",
"format": "imd",
"previewDigest": "9c1e5a07d4b3",
},
timeout=30,
)
print(res.status_code, res.json())Copied from: /docs/mandates-compile
The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
Run an installed lens over the data you send, read its findings and keep the stored result with its digest.
lenses.runDrop or add a grant in a copy of the policy, probe it, and read each verdict before and after the change.
drills.counterfactualDeclare a write with coordination.admit, read the refusal and its reason, and find the request it left behind.
coordination.admitOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.