Mandates

A Financial Mandate is the delegation of authority an agent acts under. Polivor's native format is the only one it enforces. The authoritative definition is the JSON Schema financial-mandate.v0.json; the API validates every mandate against it.

What a mandate says

Part	Meaning
`principal`	Whose money: an id and the legal name.
`authorizer`	Who delegated: name, role and email.
`agent`	The agent id and `allowed_versions`: the versions that may act.
`authority`	A short statement of what the agent may do.
`scope`	The debtor accounts, currencies, beneficiary countries and payment types the agent may use.
`beneficiaries`	How payees are chosen. Today: `{ "rule": "ALLOWLIST" }`.
`limits`	`per_transaction_minor`, `daily_minor` and `monthly_minor`, in minor units.
`approval`	`threshold_minor`: above this amount a person must approve.
`validity`	`from` and `until`, in UTC.
`policy_refs`	Names of the policies the mandate refers to.

Lifecycle

A mandate starts as a DRAFT and is put in force with POST /v1/mandates/{id}/activate. It can be suspended and resumed, or revoked for good. A version never changes: POST /v1/mandates/{id}/versions creates version n+1, which takes effect when activated. A decision records the mandate id and version it used, so old versions stay readable. Suspending or revoking takes effect on the next request, and a payment waiting for approval is denied if its mandate was revoked meanwhile.

Import from AP2

If your agent already works with an AP2 payment mandate, POST /v1/mandates/import/ap2 turns the credential into a DRAFT native mandate. AP2 stays an input format: nothing is enforced from AP2 itself.

The credential must be signed by an issuer you registered as trusted (POST /v1/trusted-issuers), with keys registered by hand, a JWKS URL, or both. A JWKS URL is fetched at every import and never cached.
The result lists what was mapped into the native mandate, what was unmapped (parts of the credential that a native mandate does not enforce) and what is missing (native fields to complete before activation).
If the credential holds a constraint that a native mandate cannot enforce, the import is refused with AP2_UNENFORCED_CONSTRAINTS unless you list that constraint in acknowledge_unenforced, one by one. A constraint type that AP2 does not define at all is never imported (AP2_UNKNOWN_CONSTRAINT).