# What's a Mandrel? The Mandrel Project binds autonomous AI agents to a declarative contract and enforces it at runtime. The names come from the machine shop, and they are not decoration: precision work is not produced by care, but by constraint. Source: https://mandrel-web-363efb.gitlab.io/docs/overview/whats-a-mandrel/ --- The Mandrel Project is a governance system for autonomous AI agents. An agent is bound to a declarative contract — the **Mandrel Spec** — that states its identity, what it is allowed to do, and the limits it operates under; a proxy called the **Collet** sits in front of it and enforces that contract on every turn. An action outside the contract does not happen. The name comes from the machine shop, where a mandrel is the shaft that gives a workpiece a true axis while it is cut. The rest of the vocabulary follows from it, and this page explains why that vocabulary describes the problem better than a security vendor's would. A machine shop can hold a tolerance of one ten-thousandth of an inch. It does not achieve that by being careful. It achieves it by removing degrees of freedom. Every fixture on the floor exists to take away a way the work could move. The material is not asked to behave; it is held so that misbehaving is not among the options. What remains after everything else has been constrained is the cut you intended. That is the whole argument for governing autonomous agents, and it is why this project borrows a machinist's vocabulary rather than a security vendor's. The names are not decoration. Each one does the job its namesake does. --- ## The mandrel — a true axis the part does not have Take a rough casting with a bored hole through it. You need the outside diameter to run true to that bore. Chuck the casting by its outside and you have already lost: you would be machining the outside true to *itself*, which tells you nothing about where the bore actually is. So you mount it on a **mandrel** — a precision shaft that fits the bore. The mandrel supplies an axis the casting does not possess on its own. Every cut you take afterwards is concentric to that axis, because the axis is the one thing in the setup you know to be true. An agent has the same problem. It has capabilities, credentials and a task, and no inherent reference for what it is *supposed* to be. Ask the model what it may do and you are machining the outside true to itself. The **[Mandrel Spec](https://mandrel-web-363efb.gitlab.io/docs/spec/index.md)** is the reference axis: a declarative contract stating the agent's identity requirements, reachable network, delegation limits, cost ceiling and risk envelope. It exists outside the agent, it is not authored by the agent, and everything downstream is trued to it. A mandrel is also the only part of the setup you inspect before you start. If the mandrel is bent, nothing made on it is worth measuring. --- ## The collet — even pressure on both the tool and the material A **collet** is a tapered sleeve, slit along its length, that closes evenly around whatever it holds. Three properties matter, and all three carry over. **It grips concentrically.** A three-jaw chuck applies force at three points and can distort what it holds. A collet closes uniformly, so the part it releases is the part it received. Governance that deforms the thing it constrains is not governance; it is damage. **It is sized.** A collet accepts one diameter, or a very narrow range around it. Present it stock that is out of range and it does not grip — it refuses. That refusal is the point. It is not a warning or a log line; it is a mechanical fact. **It holds both the tool and the workpiece.** In a mill, the collet holds the cutter. In a lathe, it holds the bar stock. This is the part of the metaphor that earns its keep: the same device constrains the thing doing the work and the material flowing through it. The **[Collet](https://mandrel-web-363efb.gitlab.io/docs/reference/collet.md)** sits in the request path as a sidecar and does exactly that. It clamps the agent — the tool — to what its spec permits, and it clamps the material — the user's delegated authority, the task, the budget, the data crossing the boundary. Every turn passes through the grip. Nothing reaches the workpiece except through it. And when the request does not fit the spec, the Collet does not proceed carefully. It does not grip. --- ## The gantry — the frame everything else is true to A gantry machine is a bridge spanning the work envelope, carrying the spindle along rails. It never touches the material. Ask what it contributes and the answer is *rigidity*: it establishes the coordinate system within which every other tool operates, and it holds that geometry while forces try to push it out of true. Rigidity is not glamorous. It is also the reason the machine can be trusted at all, because a cut is only as accurate as the frame it was taken in. The **[Gantry](https://mandrel-web-363efb.gitlab.io/docs/reference/gantry.md)** is the platform layer: distributing configuration, provisioning workload identity, injecting the sidecar, defining the envelope inside which agents may be positioned. It enforces nothing at the level of an individual turn. It makes the enforcement mean something, by ensuring that every agent is mounted the same way in the same frame. --- ## Metrology — knowing, rather than believing At the end of the shop is a temperature-controlled room with a coordinate measuring machine, gauge blocks and a granite surface plate. Nothing is manufactured there. It is where you find out whether what you manufactured is what you intended. Two things happen in that room, and the second is easy to miss. The first is inspection: the part is measured against the drawing and either conforms or does not. The second is **traceability** — the instruments themselves are calibrated against references that are calibrated against national standards. A measurement means nothing unless you can say what it is measured against. A shop that inspects with an uncalibrated gauge is not measuring; it is guessing with equipment. The **[Metrology Lab](https://mandrel-web-363efb.gitlab.io/docs/reference/metrology-lab.md)** is that room. It is where an agent is checked against platform policy before it is allowed to run, where the approved result is cryptographically signed so downstream components can verify what they received, and where the reference data lives — including the rate table that gives a cost budget a fixed meaning rather than a number that drifts with whichever model was used. An agent that has not been through the lab is not a bad agent. It is an unmeasured one, which is a different and more honest thing to say. --- ## The mapping | Machine shop | Mandrel Project | What it constrains | | :--- | :--- | :--- | | Mandrel — reference axis | [Mandrel Spec](https://mandrel-web-363efb.gitlab.io/docs/spec/index.md) | What the agent is trued to | | Collet — concentric grip | [Collet](https://mandrel-web-363efb.gitlab.io/docs/reference/collet.md) | The tool and the material, every turn | | Gantry — rigid frame | [Gantry](https://mandrel-web-363efb.gitlab.io/docs/reference/gantry.md) | The envelope work happens inside | | Metrology lab — traceable measurement | [Metrology Lab](https://mandrel-web-363efb.gitlab.io/docs/reference/metrology-lab.md) | Whether the result is what was intended | | Tolerance | `risk-profile` and enforcement matrices | How much variation is acceptable, per part | | Workpiece | The user's inputs and outputs | The thing being produced | | Cutting tool | The agent and the tools it calls | The thing doing the work | --- ## Where the metaphor holds It holds on the central claim, which is why it was chosen: **precision is a product of constraint, not of intention.** No machinist believes a part will come out right because the operator meant well. The fixture is the reason. Applied to agents, that argues for governance expressed as infrastructure the agent cannot edit, rather than as instructions the agent is asked to follow. It holds on refusal. A collet that will not close is not a failure of the shop; it is the shop working. A governance layer that terminates an ambiguous action is doing the same thing, and should be no more apologetic about it. It holds on measurement. A shop that ships uninspected parts and a platform that deploys unverified agents are making the same bet. ## Where it breaks Three places, and they are worth stating plainly. **Steel does not explore.** A workpiece has no strategy. It sits where it is held. A language model actively searches for paths to its goal, which means constraints must anticipate a counterparty that is looking for the gaps — not merely a material that might slip. This is the largest gap in the analogy, and it is why the Spec bounds *capabilities* rather than only motion. **A part is machined once; an agent runs continuously.** Tolerance in a shop is verified on a finished object. Agent behavior is a distribution over many runs, and a setup that produced a good part this morning can produce a bad one this afternoon without anything visibly changing. Inspection has to be continuous, which is a stronger requirement than first-article inspection. **The material is not neutral.** Bar stock does not carry an identity or an authorization. An agent's inputs do — they arrive with a user's delegated authority attached, and that authority is itself something to be constrained. There is no machine shop equivalent of material that shows up holding a set of keys. A metaphor that explains everything has stopped being a metaphor. This one is useful because it makes the shape of the problem legible, and because the discipline it points at — remove degrees of freedom, then measure what you made — is the right discipline even where the analogy runs out. --- Start with the [contract](https://mandrel-web-363efb.gitlab.io/docs/spec/index.md), or read [how the pieces fit together](https://mandrel-web-363efb.gitlab.io/docs/overview/architecture.md).