Agents and systems acting under mandates

Implementation note — engineering experience from building against these rules. This page describes practice, not law.

A credential proves that something was issued. An action is allowed only if the authority behind that credential covers this action, for this principal, within this scope, and is still in force at this moment. A system that runs one check where two are needed will act without authority while every signature validates. The new EU instruments make this distinction legally load-bearing.

Who this page is for

Teams building services where software acts for organisations — filing, signing, transacting, or (increasingly) AI agents doing all three — and the relying parties who must decide whether to honour those actions.

What the law actually authorises

The digital EU power of attorney authorises "a person to represent the company" [Directive (EU) 2025/25, Art. 16c(1)]. The eIDAS attribute class is "powers and mandates to represent natural or legal persons" [Regulation (EU) 2024/1183 (eIDAS 2), Annex VI, point 9]. Both instruments speak of persons. Neither creates a category of autonomous software as attorney. A system acts under a person's or organisation's authority: the mandate chain ends at a human or legal person, and your architecture has to preserve that chain.

Valid token, not allowed action

The failure pattern. A relying party receives a presentation: well-formed attestation, valid signature, trusted issuer, not expired. Every cryptographic check passes. The action can still be one the company never authorised, because:

• Scope. The instrument covers registering a branch; the action is filing a merger. The acceptance rule only ever went as far as "as specified in the document" [Directive (EU) 2025/25, Art. 16c(2)]. An out-of-scope action has no cover at all.
• Type. The representation is joint, and one of two required actors is acting alone. Joint-versus-sole is first-class data in both the certificate [Directive (EU) 2025/25, Art. 16b(2)(j)] and the power of attorney template's "type of representation" field [Directive (EU) 2025/25, Art. 16c(4)].
• Time. The instrument was revoked this morning. Where the qualified-attestation rule applies, validity ends "from the moment of its revocation" with no reversal [Regulation (EU) 2024/1183 (eIDAS 2), Art. 45d(4) of Reg. 910/2014 as inserted]. The credential in the presenter's wallet does not vanish when that happens, so the signature stays valid after the authority has gone. See Revocation.
• Chain. The grantor's own authority had limits, and the grant exceeded them. The verification at granting [Directive (EU) 2025/25, Art. 16c(1), second subpara.] checks this once, at issue time. It cannot re-run itself later.

The law puts the same split on the record: relying parties, not wallets, "shall be responsible for carrying out the procedure for authenticating and validating" what is presented to them [Regulation (EU) 2024/1183 (eIDAS 2), Art. 5b(9) of Reg. 910/2014 as inserted]. Verifying the artefact is the minimum. Authorising the action is the actual job.

The check that has to run at action time

What we have converged on in practice, per action — not per session, per action:

1. Resolve the actor to a mandate (the mandate object), not just to an identity.
2. Test the action against the mandate's scope and constraints — procedure, counterparty, value, jurisdiction.
3. Test the type — is a co-actor required, and present?
4. Test freshness. Check status against the authoritative source: the register where filed, revocation status where the attestation scheme provides it. Agree how stale a check is allowed to be and write it down, because checking every time has a cost and never re-checking has a bigger one.
5. Log the decision with the evidence used. When the action is disputed later, "were they allowed at the time?" is answered by the log.

For AI agents specifically, one more rule from experience: narrower, shorter mandates. An agent that can retry and act at machine speed does far more damage with a broad mandate than a person can. The template's scope field is the control the law gives you. Use it.

What we are not claiming

No EU instrument currently defines "AI agent mandates". What exists is: persons, powers of attorney, attestations of powers and mandates, and relying-party duties. The engineering above is how we make those safe to operate. It is practice, not law, and it will be revised as the implementing acts and national transpositions land.