Aroha Protocol

Cryptographically bounded authority for every agent in the chain.

Aroha Mandates let any agent that delegates keep cryptographically enforceable control over every agent it hands work to. No agent can exceed the scope it was granted.

Docs · Support matrix · Local sandbox · Support · Spec

---

Mandate-first agent authority

import { generateKeyPair, generateDid } from "@aroha-sdk/core";
import { issueIntentMandate, attenuateToPayment, verifyMandateChain } from "@aroha-sdk/credentials";

const human = await generateKeyPair();
const assistant = await generateKeyPair();
const flightAgent = await generateKeyPair();
// Content-addressed DIDs (did:aroha:z…) commit to their own public key,
// so a verifier needs no registry lookup to check signatures.
const humanDID = generateDid(human.publicKey);
const assistantDID = generateDid(assistant.publicKey);
const flightAgentDID = generateDid(flightAgent.publicKey);

// Human issues an intent mandate to the assistant ($500, 1 hour TTL)
const intent = await issueIntentMandate(
  humanDID, assistantDID,
  { spendLimitUsd: 500, merchantCategory: "4511" }, // MCC 4511 = airlines
  human.privateKey,
  3_600_000,
);

// The assistant attenuates scope downward to the flight agent ($300 of the $500).
// The child token embeds the signed chain back to the human.
const payment = await attenuateToPayment(
  intent, flightAgentDID,
  { spendLimitUsd: 300, merchantCategory: "4511" },
  assistant.privateKey,
);

// Flight agent verifies every link back to the human root before acting
const result = await verifyMandateChain(payment.token, undefined, {
  expectedRoot: humanDID,          // the human authority must come from
  expectedGrantee: flightAgentDID, // the flight agent itself
});
// result.valid === true, result.chainVerified === true,
// result.mandate?.constraints.spendLimitUsd === 300.
// A link that widens scope, or is signed by anyone but its grantor, fails.

The example names each party with a did:aroha:z… identifier, which commits to its own key and verifies offline. On main (unreleased) a party can also be named by an HTTPS address that publishes its key, such as https://agents.example.com/assistant, for agents that already have one: see Web identities and the runnable examples/web-identities. A mandate can also be issued as a JWT that a stock JWT library reads: Mandates as JWTs.

---

The problem

Agents now act for people and hand work to other agents and tools, often run by other companies. MCP and A2A connect them; identity providers name them. Nothing that travels with the work proves what each agent was allowed to do, stops the whole chain when the person changes their mind, or leaves a record anyone else can check.

Approach	What you get today
Per-hop credentials (API keys, OAuth tokens)	Each hop enforces its own key. The person's limit, purpose and expiry are lost along the way.
Framework guardrails	Checks inside one codebase. Nothing survives the hop to another vendor's agent.
Aroha Mandates	A signed chain back to the person. Scope can only narrow. Any verifier checks it offline; revocation is pushed; every action, allowed or refused, gets a signed receipt.

Aroha answers four questions for every action: who is acting, what were they allowed to do, can it be stopped, and what actually happened. It works with MCP, A2A and your identity provider rather than replacing them. See what Aroha is (and is not).

---

How it works

1. Human issues a mandate — signs an IntentMandate with authorized actions, a spending cap, and a TTL. Cryptographically bound to the receiving agent's DID.
2. Any agent attenuates — delegates a strict subset of that scope to the next agent, signed by the delegating agent. Scope narrows, never widens.
3. Every agent verifies — before acting, an agent verifies the mandate chain back to its human origin, offline. A forged, altered, widened or expired link fails verification.
4. Revoke and prove — the person can revoke at any time; the registry witness pushes the revocation to verifiers. Every allowed or refused action produces a signed receipt.
5. Deploy in your existing stack — bridges for MCP, LangChain, A2A, and Composio. Mandate verification drops in in two lines.

---

Try it in sixty seconds

An inbox assistant that may read mail and propose what to archive, and may never delete, no matter what it is told. No server, no keys to configure, runs offline against the published packages.

git clone https://github.com/ArohaLabs/aroha-protocol
cd aroha-protocol/examples/mandates && npm install
node inbox.mjs

This is the beginning of the README. Read the rest at the original. Read the full README ↗