The mandate object

Implementation note — engineering experience from building against these rules. This page describes practice, not law.

Before you can automate "may this person do this thing for that company", you need the authority itself as data. Not a PDF, not a boolean on a user record: a mandate with a grantor, a grantee, a scope, a type, a validity window and a status. This page describes the shape we use in practice. Where the law fixes a field, we cite it. Everywhere else this is experience, not obligation.

Why a document is not enough

A signed power of attorney answers one question: was this granted properly? Operations ask a different question, repeatedly: is this action, by this person, for this company, allowed now? To answer that at machine speed the document's content has to become structure. The law already commits to a minimum structure: the template for the digital EU power of attorney must contain "at least the data fields relating to the scope of representation, the person authorised to represent the company and the type of representation" [Directive (EU) 2025/25, Art. 16c(4)]. Those three fields are the start of the mandate object.

The fields, and where they come from

Two additions the law does not require but practice does: a validity window (open-ended mandates accumulate risk; short-lived, renewable ones bound it) and a constraint set on the scope (value limits, counterparty limits, procedure limits). Scope written as prose gets read once by a human. Scope written as structure gets checked by a system every time.

Lifecycle, not lookup

The expensive modelling mistake is treating authority as a lookup: is_authorised: true. Authority is a lifecycle. It is granted by someone whose own authority was checked, possibly amended, possibly revoked, and where the qualified-attestation rule applies the revocation is valid "from the moment of its revocation" and irreversible [Regulation (EU) 2024/1183 (eIDAS 2), Art. 45d(4) of Reg. 910/2014 as inserted]. A mandate object needs its history attached, because you will be asked not only "may they act?" but "were they allowed to act on 14 March?". Only the event log answers that.

What this buys you when the law arrives

When the Commission's template is published (it was due by 31 July 2026 [Directive (EU) 2025/25, Art. 24(2)(e)]) and wallets start carrying attestations of "powers and mandates to represent natural or legal persons" [Regulation (EU) 2024/1183 (eIDAS 2), Annex VI, point 9], systems that already hold mandates as structured records can take the attestation as evidence into an existing model. Systems that hold PDFs will be parsing prose against a deadline.