# ID MANDAT: A Machine-Readable Credential for the Agents of a Company ID MANDAT

[2 · Identify](/category/identify/)
Candidate · auto-drafted, unreviewed · confidence 60%

| ID MANDAT: A Machine-Readable Credential for the Agents of a Company |
| --- |
| Category | [Identify](/category/identify/) |
| Governed by | Individual Internet-Draft, not an IETF working group product; the reference registry is operated at idmandat.com |
| Status | Internet-Draft, Intended Status: Informational; individual submission describing a deployed beta (version 0.3), not the product of an IETF working group |
| Phase | draft |
| Implementation | prototype |
| Adoption | unmeasured |
| Version | draft-koenig-idmandat-credential-00 (2026-10-16) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-koenig-idmandat-credential-00](https://datatracker.ietf.org/doc/html/draft-koenig-idmandat-credential-00) |
| Found at | /.well-known/idmandat.json |
| Last checked | 2026-10-19 |
| Freshness | current · checked 2026-10-19 |
| Solves | Prove an agent's identity, Describe an agent's capabilities, Delegate a user's authority to an agent, Attribute and measure agent traffic |

ID MANDAT: A Machine-Readable Credential for the Agents of a Company is an agentic-web standard (well-known file) at step 2, Identify, governed by Individual Internet-Draft, not an IETF working group product; its own status is "Internet-Draft, Intended Status: Informational; individual submission describing a deployed beta (version 0.3), not the product of an IETF working group" (draft). It answers: How can a recipient find out which company stands behind an agent and what that agent is declared to be allowed and not allowed to do on the company's behalf? Adoption is unmeasured, last verified 2026-10-19.

[Identify](/category/identify/) Describes a JSON credential file a company publishes at /.well-known/idmandat.json, naming the company and its agents with per-agent 'may' and 'mayNot' mandates. A DNS TXT record at _idmandat.<domain> ties the file to the domain. A public registry checks both and returns Ed25519-signed answers with check levels and revocation states. The agent details are operator declarations and not verified by the registry. It complements Web Bot Auth, which proves key possession but not who operates the agent.

## Discovery and probe

well-known file at /.well-known/idmandat.json, linked to the domain by a DNS TXT record at _idmandat.<domain> · /.well-known/idmandat.json

```
GET /.well-known/idmandat.json
parse:     Parse JSON; check that 'domain' equals the fetched host and that 'agents' is present; optionally resolve the TXT record _idmandat. for 'v=idmandat1'
on absent: Treat as no declaration; absence is not evidence against the agent
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-19 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-koenig-idmandat-credential-00)

## Instances

No instances recorded yet.

## See also

## References

- Internet-Draft defining a credential file at /.well-known/idmandat.json, a DNS TXT proof record at _idmandat, and a signed Ed25519 registry lookup answer format; described as a deployed beta (version 0.3). — [https://datatracker.ietf.org/doc/html/draft-koenig-idmandat-credential-00](https://datatracker.ietf.org/doc/html/draft-koenig-idmandat-credential-00) (2026-10-16) REPORTED

[JSON](/data/protocols/idmandat-credential.json) · [Markdown](/protocols/idmandat-credential/index.md)