mandates.compileModule 03Write an agent's charter as code, see what it would change about who may do what, and apply it as the mandate's next version.
mandates.compile turns a mandate written in imd, Cedar or Rego into grants. simulate shows what a change would permit and writes nothing; compile lands it as the mandate's next version, bound to the preview you read when you send its digest. No model is involved.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abusemandates.compile has no replay route. The console replays a period through history/counterfactual, then compiles. Call that route with from, to and addGrants or dropGrants before you apply a change.
Plane module
mandatename, grants, sourceFormat, engine, version, and any objectives and priority./docs/mandates-compileAPI referenceRoutes, bodies and status codes./docs/mandates-compileOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./dashboard-preview/mandatesStart freeCreate a workspace and admit your first intent./auth/signup
applied0 when you send apply: false.revokedwithheldcaseId.snapshotstored), signed (signed, alg), and under which key.previewDigestnull when you send apply: false.unpreviewedtrue when the apply was not bound to a preview digest.findingslint and simulate: each has a severity, a code such as silent-no-op or shadowed, and a message.format set to imd, the default. A mandate <name> line, then one rule per line: allow <action> on <resource> for <principal>. A line that matches no pattern compiles to nothing.
format set to cedar. permit(...) statements that test principal, action and resource by equality. forbid, when and unless are refused with a 400. A subset, not a Cedar engine.
format set to rego. allow { ... } blocks that test input.principal, input.action and input.resource by equality. not, some and walk are refused. A subset, not OPA.
Name it with mandate <name> and state each grant as principal, action and resource. Optional lines say what it is for: objective decrease cloud-spend and priority 4.
lint flags rules that compile to nothing, wildcards and shadowed grants. simulate returns the diff against the constitution in force and a digest, and writes nothing.
compile replaces the mandate where it stands as the next version. A grant the new version drops passes to another mandate or pack that still makes it, or is revoked and listed in .
world stands in for your workspace; nothing leaves this page. mandates.compile docs
Press Run (or ⌘/Ctrl + Enter) to decide the request on the left.
It runs in this browser: the plane’s own kernel, with no key, no account and no network call. Change an agent, a lease or a rule on the left and run it again to see the verdict move.
A request in the shape the API accepts, and an example response in the shape the module returns.
POST /api/v1/acp/mandates/compile Authorization: Bearer av_workspace_•••• Content-Type: application/json { "source": "mandate billing-writes\nallow write on repo:payments/main for did:web:acme.example:agent:billing", "apply": false } → 200 { mandate, applied, snapshot, previewDigest }
{
"mandate": {
"name": "billing-writes",
"grants": [
{
"principal": "did:web:acme.example:agent:billing",
"action": "write",
"resource": "repo:payments/main"
}
],
"sourceFormat": "imd",
"engine": "regex-scrape",
"version": 1
},
"applied": 1,
"revoked": [],
"withheld": [],
"snapshot": {
"stored": true,
"signed": true,
"alg": "hmac-sha256",
:
},
: ,
:
}Compile a stricter version of billing-writes. The preview lists the narrowed grants, and the apply revokes whatever no other mandate or pack still grants.
diff compares two constitutions by what they permit. A reordered or renamed mandate reports permissionsUnchanged: true; swapping a named principal for * reports a widened grant.
A caller with policies.propose can send apply: false to compile and store the signed artifact without changing the snapshot. Applying needs policies.approve.
Run lint in CI. A rule-shaped line that compiled to no grants is an error, so a typo in imd no longer passes as an empty charter.
history/counterfactual route does that, and drills.counterfactual runs it as a drill.coordination.admit.compile applies to the workspace at once; use change-trains.list for a staged rollout.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
simulate call writes nothing: no snapshot, no mandate list and no stored artifact.compile bound to a previewDigest is refused when the mandate or the constitution it was previewed against has changed.lint finds mechanical faults such as no-op rules and wildcards, not bad intent.imd is a pattern scrape: a line that matches nothing compiles to nothing, and compile does not refuse it.mcp.enforce and github.enforce.A grant is named for its mandate, not its version: mandate:<name>/<action>/<principal>/<resource>. The version number only goes up, even when the mandate list and the snapshot disagree.
The digest covers the compiled grants and the constitution they land on, not the source text, the dialect or the clock. Reindenting a charter keeps an approval valid.
A preview carries a 15-minute lifetime in expiresInMs. It is enforced when previewAt is sent with compile; otherwise only drift in the digest refuses the apply.
compile stores an artifact in the config store under acp:mandate:<workspace>:<name>. It is signed with an HMAC only when the gateway signing secret is bound; otherwise signed is false.
objective and priority stay on the mandate and are not in the digest. detection.run reads them to find two mandates that pull one metric in opposite directions.
policies.approve and apply: false needs policies.propose. A caller without it gets 403, and a request naming no caller gets 401.apply: false is not a preview: it still writes the signed artifact. Use simulate when nothing may be written.permit or allow blocks, is refused with a 400.coordination.mandates.compile action takes source, format and only, so the preview binding fields are REST only.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/mandates/compileCompile a mandate and apply it, or store it unapplied./api/v1/acp/mandates/simulatePreview a change and return its digest; writes nothing./api/v1/acp/mandates/listList the mandates in force, with their versions./api/v1/acp/mandates/lintCheck a mandate for rules that do nothing./api/v1/acp/mandates/diffCompare two constitutions by what they permit.coordination.mandates.compileCompile a mandate, without the preview binding.coordination.mandates.listList the workspace's compiled mandates.coordination.admit01Intralock admissionDecide every action before it happens: an agent declares its intent, and Intralock admits it or names the reason it may not.detection.run07Conflict detectionTurn contention between agents into a filed case with the evidence attached, instead of an alert nobody can answer.drills.counterfactual34Counterfactual simulationAsk what a policy change would do before you make it: re-run chosen requests with grants dropped or added, and see each answer change.civics.settings23Workspace constitutionSet how fast the humans must answer your agents' questions, and who is on call, for each urgency in this workspace.change-trains.list24Staged change trainsRoll a change out to part of the fleet first, check it against measured signals, and move it forward one stage at a time.packs.list25Signed pack registryBring in a pack of agents, grants and drills from outside, and know who signed it and whether a byte changed on the way.revokedSend previewDigest, previewBefore and previewAt with compile. If the mandate or the constitution moved since, the call is refused with a 409 that names which half. Without a digest it applies and answers unpreviewed: true.
applylenses.run26