Start here · hard gate

Authorize an agent action exactly once.

Action Authority is the contract between an organization and an agent executor. It answers whether one named agent may perform one named action on one named resource, for a bounded period and use count.

1 · Create a bounded mandate

Use an account-owned key with assess:write. A mandate has a subject, an allowlist, a time window and a fixed action budget. A child mandate may only reduce its parent's authority.

curl -s https://api.fidacy.com/v1/action-mandates   -H "Authorization: Bearer $FIDACY_ENGINE_API_KEY"   -H "Content-Type: application/json"   -d '{
    "subject": "support-refund-agent",
    "version": "refunds-2026-08",
    "allow": {
      "actions": ["stripe.refund.create"],
      "resources": ["stripe:payment_intent:pi_demo_847"],
      "maxActions": 1,
      "maxDelegationDepth": 0
    },
    "window": {
      "notBefore": "2026-08-24T09:00:00Z",
      "notAfter": "2026-08-24T18:00:00Z"
    }
  }'

2 · Decide the exact request

Hash the local action context before sending it. Fidacy binds the decision and any grant to the action, resource and contextHash, rather than receiving the underlying prompt, customer record or payment details.

curl -s https://api.fidacy.com/v1/action-mandates/$MANDATE_ID/decisions   -H "Authorization: Bearer $FIDACY_ENGINE_API_KEY"   -H "Content-Type: application/json"   -d '{
    "action": "stripe.refund.create",
    "resource": "stripe:payment_intent:pi_demo_847",
    "contextHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
  }'

{
  "decision": { "id": "…", "status": "ALLOW" },
  "receipt": "eyJ…",
  "grant": "eyJ…",
  "expires_at": "2026-08-24T09:02:00.000Z",
  "anchor": { "status": "queued", "receipt": "eyJ…" }
}

3 · Redeem inside the executor

Do this immediately before the side effect. Redemption is atomic: a replay receives 409 grant_replayed; an invalid grant receives 400 invalid_grant. In either case, the executor must refuse to call the protected system.

curl -s https://api.fidacy.com/v1/action-grants/redeem   -H "Authorization: Bearer $FIDACY_ENGINE_API_KEY"   -H "Content-Type: application/json"   -d "{ \"grant\": \"$FIDACY_GRANT\" }"

Operating the boundary

What this does and does not prove

• ·A redeemed grant proves the Fidacy executor accepted the signed grant before continuing its own side-effect path.
• ·It does not by itself prove that Stripe, a CRM or another external system completed the requested effect. Persist the downstream receipt with your operational record.
• ·It does not observe actions that never pass through a Fidacy-connected executor. Use Control Coverage to expose the live scope and any evidence gaps.