drift - Mandate Guard for AI Agents

Signing a mandate is a one-time event. The consequences are not: between the signature and the payment, an agent can drift - overspend, pay the wrong recipient, swap the currency, act after expiry, or call the action something the mandate never allowed.

This skill wires the agent to check each consequential action against the mandate right before it happens, and to stop on the first violated rule.

What is checked

• Six rules in fixed order - amount, payee, audience, currency, validity window, intent. The refusal names the most important reason, not an incidental one.
• Deny by default: anything unclassified is refused; silence is not permission.
• Append-only ledger with a chain fingerprint - a denial is evidence, not a log line.
• Batch mode for whole plans: per-action verdicts plus one fingerprint for the run.

How it works

The skill calls the drift checker over MCP right before any action that spends money, moves a credential or changes state on someone else's behalf. The checker decides; the agent (or your payment stack) executes. Works with any MCP-capable agent: Claude Code, Cursor, Copilot, Codex, Windsurf, Cline, Zed and others.

What's inside

• SKILL.md - the enforcement loop the agent follows
• reference/rules.md - the six rules with edge cases and examples
• reference/mandates.md - ready mandate templates: trading bot, shopping agent, refund operations
• reference/setup.md - connection guide for hosted and local deployment

Honest limits

• The checker enforces; it does not verify mandate signatures (that is AP2's step) and does not prove what actually happened afterwards (a separate audit tool does that).
• Intent is untrusted input by design - it is checked against the allowlist, never believed.
• The checker decides; it never executes the action.Agent drift occurs when an AI performs actions outside its original signed permissions. This skill implements a continuous check between intent and execution, ensuring every consequential action matches a principal's mandate. It enforces spending caps, payee restrictions, and time windows before funds are moved or messages are sent.

What it does

• Mandate verification matches proposed actions against signed JSON permission sets.
• Budget enforcement checks integer minor units to prevent floating-point rounding errors in payments.
• Entity validation confirms payee IDs and audience URIs against allowlists.
• Temporal gating restricts actions to specific Unix timestamp windows.
• Session reporting processes batch plans for portfolio rebalancing or bulk transfers with per-action verdicts.
• Tamper evidence generates chain fingerprints to provide an append-only digest of every decision.

How it works

1. Load mandate by receiving a signed JSON object from the principal.
2. Intercept action by calling drift_check with the proposed intent and transaction details before execution.
3. Handle denial by stopping immediately on a DENY verdict and reporting the specific failed rule.
4. Audit session by using drift_session for multi-step workflows to get a comprehensive allowed/denied report.

Frameworks & tools

This skill requires the drift MCP server. It provides tools including drift_check, drift_session, and drift_explain.

Why this beats prompting it yourself

LLMs frequently ignore system instructions when faced with complex logic or user pressure. This skill offloads the logic to a fixed-rule engine that defaults to DENY, ensuring safety isn't lost to model hallucination or instruction drift.

Use cases

• Trading bots preventing unauthorized asset swaps or over-budget trades.
• Shopping agents restricting purchases to specific vendors and price caps.
• Customer service agents gating refund operations behind signed manager mandates.
• Outbound communications ensuring external messages match approved audience URIs.

Known limitations

Requires a connected drift MCP server (hosted or local). Does not perform cryptographic signature verification or post-action auditing.