Mandates, receipts, and grants are signed when they are created
The runtime signs mandates, receipts, and execution grants so teams can verify integrity and keep older signatures valid through key rotation.
Trust, security, and evidence
Security claims should end in artifacts operators can review.
MandateOS is stronger when the security story is tied to receipts, approval events, execution grants, and a tamper-evident audit chain rather than broad promises alone.
Verifiable receipts for meaningful actionsApproval events attached to the request pathExecution grants for escalated workAudit chain verification for retained history
Sensitive tokens are encrypted before storage
At-rest credential storage uses authenticated encryption so the control plane can protect secrets and detect tampering.
API keys are stored as hashes, not raw secrets
Key verification uses timing-safe comparison so the runtime does not have to keep plain-text secrets on disk.
Audit events are chained so later modification is visible
A SHA-256 audit chain makes review stronger because historical edits break verification instead of staying invisible.
Inter-service requests are signed and scoped
Service-to-service calls are authenticated across method, path, body, and expiry. Mutating requests also require idempotency keys.
Evidence is organized for approval and later review
The security model becomes practical when operators can see the request, the escalation decision, and the receipt together.