A mandate is the permission boundary that defines what an agent, user, or system is allowed to do. In cybersecurity, it is the line between a suggestion and an authorized action. A mandate can limit which data can be read, which tools can be called, what transactions can be started, and whether a human approval is required before execution.
Mandates matter because many attacks exploit overbroad delegation rather than weak passwords alone. If an AI agent, script, or service account has too much authority, a single prompt injection, stolen token, or logic flaw can turn into unauthorized access or fraudulent action. Defenders reduce this risk by using least privilege, scoped tokens, step-up approval, policy enforcement, and detailed audit logs that prove what was allowed and why. In agentic systems, the mandate is the security boundary that keeps a capable system from acting outside its role.