HumanMandate

Credit cards bind to cards. Allowances bind to addresses. Revoke either and the counterparty returns with a new credential.

HumanMandate is an agent card for unsupervised AI spenders, bound to a World AgentBook humanId and enforced in Solidity on World Chain mainnet: daily caps, a locked recipient, one-tap revoke that survives brand-new agent addresses, and a fresh Selfie liveness check to raise limits. Routine spend inside the cap needs no human present — like Face ID for money.

The core is one Solidity contract, HumanMandate, built with Foundry and live on World Chain mainnet.

AgentBook humanId — the contract reads the live AgentBook registry from Solidity to resolve agent→human — so caps and revocation follow the person, not the wallet: after revoke, a brand-new agent address still reverts NotAuthorized. All policy is enforced as custom-error reverts (CapExceeded, NotAuthorized, LivenessRequired)

Raising limits is the only action that requires a human. The World App mini-app (Next.js 15 + MiniKit) runs a Selfie liveness check; our backend verifies the proof (IDKit + RP signing — MiniKit 2.x removed verify()), binds it to the payer via signal_hash, and an attestor key signs an EIP-712 StepUp attestation that the contract checks inside raiseLimits.