Zero-Knowledge Mandates

Mandate Lifecycle Example

A principal issues a mandate, an orchestrator delegates part of it to a sub-agent, and the sub-agent spends within its bound — each step a proof, none of it disclosing the principal:

// Principal issues a mandate to its orchestrator agent
const mandate = await principal.issueMandate({
  assetId: "usdc",
  settlementDomain: "zka:mainnet",
  cap: 800_000000n,               // 800 USDC, 6 decimals
  expiry: hoursFromNow(24),
  policy: {
    version: 2,
    maxPerSpend: 200_000000n,
    recipientRestricted: false,
    depthLimit: 1                 // sub-agent may not re-delegate
  }
});

// Orchestrator delegates part of its cap to a sub-agent (SPLIT + rebind)
const { delegated, retained } = await orchestrator.delegatePartial(mandate, {
  cap: 300_000000n,
  holderKey: subAgent.publicKey
});
// subAgent returns a possession proof binding its own key before
// the delegator submits the transition — a rebind to a key no one
// controls would otherwise burn the delegated authority silently.

// Sub-agent spends within its delegated cap
const proof = await subAgent.spend(delegated, {
  amount: 150_000000n,
  recipient: merchant.zkaAddress
});
// Settlement layer verifies, atomically: valid mandate + within cap +
// unexpired + unrevoked + policy satisfied + the conjoined ZKA value leg.
const result = await settlement.submit(proof);
// result.accepted === true

The merchant learns only that the spend was authorized and settled — never the principal, the original cap, or anything spent before.