It sets a budget, the kinds of agents allowed, the data rules, and the amount above which the human must approve a call. On Holon, every paid call runs under exactly one mandate. The gateway checks it before anything is spent: an agent outside the allowed capabilities is refused, a call that would overrun the budget is refused, and a call above the approval threshold waits for the human.
A mandate has an issuer (the human who pays) and a grantee (the agent that acts). The agent cannot change it, widen it, or approve its own calls.
Example: a mandate of 50.00 EUR in total, at most 3.50 EUR per call, extraction and finance agents only, approval above 1.00 EUR, no data kept longer than 7 days.