Mandates
Set the rules for actions routed through Oxagen. Each agent works under its own identity, permissions, toolbelt, steering, and budget, and together those terms make up its mandate.
The Bug fixer agent's mandate. Security owns its access, Finance owns its budget of $20 a run with $11.64 spent, Engineering owns its tools, and Oxagen keeps the record of 412 frames. A request to read the repository is allowed by a rule.
One agent's mandate
- AccessSecurityAsks for GitHub when the task needs it
- Budget and rulesFinance$11.64 of $20 this run
- EquipmentEngineering
get_issuecreate_pull_requestrun-tests - RecordOxagen412 frames recorded
Controls on routed calls
An agent with a standing token can merge to main at 3 a.m., and the team finds out when the deploy breaks. When a call is routed through Oxagen, a rule your team wrote answers it first. The rule allows the call, denies it, or routes it to a named person, and a denied call does not reach the tool.
Oxagen checks those terms on calls routed through it and records each decision, so the people who set the limits can see how they applied.
Parts of a mandate
| Part | What it sets | How it changes |
|---|---|---|
| Access | The consequences the agent may act on, with an expiry | A grant by a person who holds the organization role the workspace names for each consequence |
| Budget | Limits on what the agent may spend and how many calls it may make | An update to the mandate's limits |
| Rules | Whether a routed call is allowed, denied, or sent to a person | The workspace's decision rules |
| Tools | The tool patterns the agent may call | A grant names patterns that must match a declared tool |
| Steering | The instructions a run reads when it starts | A reviewed steering pull request |
Where controls apply
In scope
- Tool calls and model calls that pass through Oxagen's hooks or its local gateway.
- Agent requests checked against the agent's own role and its delegation ceiling, on every plan.
- Observe mode, where Oxagen records what the policy would decide and lets the call go ahead. Budget and model limits still apply to model calls routed through Oxagen.
Out of scope
- Actions the agent's computer never reports to Oxagen.
- Cursor's model calls, which go to Cursor's own servers, so budget limits on model calls do not reach them.
- Asking a person on harnesses that cannot hold a call. Codex and Cursor get a denial with the reason instead.
Product walkthrough
Review the authority, tools, and budget for one supported agent.