{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://weverlabs.com/schemas/wever-authority-mandate.schema.json",
  "title": "Wever Authority Mandate",
  "description": "A signed, time-bounded grant of exact authority from a principal to an agent.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "mandate_id",
    "mandate_version",
    "mandate_state",
    "principal_reference_hash",
    "identity_provider",
    "agent_id",
    "permission_mode",
    "approval_mode",
    "allowed_tools",
    "allowed_rails",
    "allowed_resources",
    "budget",
    "public_activity_consent",
    "consent_receipt_hash",
    "scope_hash",
    "not_before",
    "expires_at",
    "nonce",
    "issued_at",
    "signed_context",
    "signing_version",
    "signed_hash",
    "signature",
    "signature_state"
  ],
  "properties": {
    "mandate_id": { "type": "string", "pattern": "^authority_mandate_" },
    "mandate_version": { "const": "v1" },
    "mandate_state": { "const": "active" },
    "principal_reference_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
    "identity_provider": {
      "enum": ["wever_operator", "passkey", "oidc", "internet_identity", "service_account", "external_attestation"]
    },
    "agent_id": { "type": "string", "minLength": 1, "maxLength": 200 },
    "client_id": { "type": ["string", "null"], "maxLength": 200 },
    "permission_mode": { "enum": ["read_only", "bounded_write"] },
    "approval_mode": { "enum": ["automatic_read_only", "per_action"] },
    "allowed_tools": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "enum": [
          "read_verified_commerce_activity",
          "evaluate_agent_commerce_proof",
          "inspect_authority_mandate",
          "evaluate_authority_action",
          "create_delegated_work_order",
          "publish_verified_commerce_proof"
        ]
      }
    },
    "allowed_rails": {
      "type": "array",
      "uniqueItems": true,
      "items": {
        "enum": ["packetops", "diligenceops", "energyops", "distributionops", "tokenops", "financeops", "contractops", "scout"]
      }
    },
    "allowed_resources": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": { "type": "string", "pattern": "^/(?!.*\\*)" }
    },
    "budget": {
      "type": "object",
      "additionalProperties": false,
      "required": ["max_amount_units", "currency", "max_runs"],
      "properties": {
        "max_amount_units": { "type": "number", "minimum": 0, "maximum": 1000000000 },
        "currency": { "type": "string", "pattern": "^[a-z]{3,12}$" },
        "max_runs": { "type": "integer", "minimum": 1, "maximum": 100 }
      }
    },
    "public_activity_consent": { "type": "boolean" },
    "consent_receipt_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
    "parent_mandate_hash": { "type": ["string", "null"], "pattern": "^sha256:[a-f0-9]{64}$" },
    "scope_hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
    "not_before": { "type": "string", "format": "date-time" },
    "expires_at": { "type": "string", "format": "date-time" },
    "nonce": { "type": "string", "format": "uuid" },
    "issued_at": { "type": "string", "format": "date-time" },
    "signed_context": { "const": "wever_authority_mandate_v1" },
    "signing_version": { "const": "wma_ed25519_v1" },
    "signed_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
    "signature": { "type": "string", "minLength": 40 },
    "signature_state": { "const": "signed" }
  },
  "allOf": [
    {
      "if": { "properties": { "permission_mode": { "const": "read_only" } } },
      "then": {
        "properties": {
          "approval_mode": { "const": "automatic_read_only" },
          "allowed_tools": {
            "items": {
              "enum": ["read_verified_commerce_activity", "evaluate_agent_commerce_proof", "inspect_authority_mandate", "evaluate_authority_action"]
            }
          }
        }
      }
    },
    {
      "if": { "properties": { "permission_mode": { "const": "bounded_write" } } },
      "then": { "properties": { "approval_mode": { "const": "per_action" } } }
    }
  ]
}