Glossary

This page defines the domain-specific terminology used across the Mandrel Project ecosystem.

A2A (Agent-to-Agent) A communication pattern and protocol standard (originated by Google) where autonomous AI agents invoke other agents as part of a workflow. Mandrel extends the A2A Agent Card concept with hardened governance.

ACR (Authentication Context Class Reference) An OIDC claim indicating the level of assurance of the authentication event. Mandrel’s enforcement matrices use ACR levels (e.g., L1, L2) to gate high-risk tool executions.

Amorphous AI Mandrel’s term for autonomous AI agents whose execution paths are non-deterministic and non-linear — in contrast to traditional software with fixed control flow. The project’s goal is to impose deterministic governance on these amorphous behaviors.

CAE (Continuous Access Evaluation) A real-time token revocation protocol (RFC 8936). When a revocation event occurs, the Collet immediately terminates all active sessions for the affected agent — there is no polling delay.

Canonicalization (RFC 8785) The rule for reducing a document to one unambiguous byte sequence before hashing it. Mandrel uses JCS over a YAML 1.2 core-schema profile. It matters because two implementations that both “hash the canonical JSON” still disagree — the divergence is in the YAML step, where a library that reads 2026-01-01 as a timestamp or yes as a boolean produces a different hash from a document neither one rejected.

Chip The Mandrel normalized cost unit. One Chip equals the cost of one input token on the platform’s baseline model. All model costs are expressed as Chip multipliers relative to this baseline, enabling model-agnostic budget governance. Declared in spec.token-budget as decimal values (e.g. 500.0); stored internally as uint32 tenths.

ChipRateTable (MandrelChipRateTable) A platform-scoped resource loaded into the Metrology Lab that maps model IDs to Chip multipliers (input-multiplier, output-multiplier). It also declares the baseline model and its USD peg (chips-per-million-tokens). Agents reference only a model-id; the Collet and Lab resolve the actual multipliers from the active table at runtime. Loaded via PUT /v1/chip-rates. See the ChipRateTable reference.

Circuit Breaker A fail-closed mechanism in the Collet. When a governance boundary is breached or the enforcement layer is unreachable, the circuit breaker terminates the action rather than allowing it to proceed unchecked.

Collet The enforcement proxy sidecar in the Mandrel mesh. It “clamps” an agent to its Mandrel Spec by intercepting every turn, verifying identity, evaluating governance matrices, and enforcing runtime constraints. Named after the collet in precision manufacturing, which clamps a workpiece to a defined shape.

Compound Identity (“Double Badge”) Mandrel’s requirement that every Agent-to-Agent request presents two independent identity proofs: a machine identity (SPIFFE SVID via mTLS) and a human context (Nested JWT via OIDC). This prevents privilege escalation and identity wash.

doc_hash / spec_hash The two hashes carried in a Realized Spec’s signature. doc_hash covers the whole document except the signature and is what a verifier checks — it is the integrity hash. spec_hash covers the source spec block as authored, links a realized spec back to the spec it came from, and is what a lab compares for promotion idempotency. Neither substitutes for the other.

DPoP (Demonstrating Proof-of-Possession) An OAuth 2.0 mechanism (RFC 9449) that cryptographically binds an access token to an agent’s private key. Prevents token theft and replay attacks.

Enforcement Matrix A governance rule defined in a Mandrel Spec that maps request attributes (e.g., transaction.value) to actions (challenge, deny) at tiered thresholds. Evaluated by the Collet at runtime.

Gantry The component responsible for Agent Lifecycle Management in the Mandrel mesh. In production environments, the Gantry role is performed by a Kubernetes Operator that automates sidecar injection, SPIFFE SVID provisioning, and continuous health monitoring. It serves as the cluster-scoped configuration authority, distributing Metrology Lab endpoints and signing keys via the MandrelPlatformConfig CRD.

HITL (Human-in-the-Loop) A governance pattern where a human must explicitly approve a high-risk action before it executes. In Mandrel, HITL is triggered by step-up authentication (RFC 9470) when an enforcement matrix threshold is crossed.

Hop / Max-Hop A single delegation step from one agent to another. The max-hops-allowed field in the Mandrel Spec prevents infinite delegation loops; the Collet hard-enforces this limit by decrementing a counter and aborting with RESOURCE_EXHAUSTED when it reaches zero.

Identity Wash A security vulnerability where an agent performs an action under a different or elevated identity than the one originally authorized by the human operator. Mandrel’s Compound Identity model prevents this by propagating the full delegation chain via Nested JWTs.

Mandrel In manufacturing, a mandrel is a shaft or spindle inserted into a workpiece to provide internal support and define its shape during machining. The Mandrel Project applies this metaphor: the framework provides the deterministic axis that shapes the behavior of otherwise amorphous AI agents.

MCP (Model Context Protocol) An open standard interface (originated by Anthropic) that Specialist agents use to interact with enterprise systems. MCP exposes three primitives: Resources (read-only data), Prompts (standard workflows), and Tools (state-changing actions).

Metrology Lab The central governance authority for the Mandrel mesh. It accepts agent card certifications, runs the promotion gate (validating the spec and baking platform policy), and issues signed Realized Specs. It also serves the active MandrelChipRateTable and global MandrelPlatformPolicy, and publishes the mesh’s public signing keys via a standard JWKS endpoint.

Metrology Lab (the) / metrology lab (a) The Metrology Lab is the Mandrel Project’s service: registry, promotion workflow, fleet visibility, audit trail. A metrology lab is the role that service fills, defined as a contract in mandrel-metrology-spec. Anything satisfying the contract is a metrology lab — including a CI pipeline with a signing key. The managed service is one conforming implementation.

Nested JWT (RFC 8693) A JSON Web Token that contains another JWT representing the delegating principal. Mandrel uses Nested JWTs to carry the full human-to-orchestrator-to-specialist delegation chain across A2A calls without losing the original authorization context.

Orchestrator An agent responsible for intent classification and task delegation. It queries the Metrology Lab to discover appropriate Specialist agents and routes work to them via A2A gRPC calls through their Collet sidecars.

Platform Policy A MandrelPlatformPolicy document managed by a platform administrator and loaded into the Metrology Lab. It defines governance ceilings (e.g., max-hops-allowed, max-primary-chips) and a model deny-list applied during the promotion gate via min(spec, platform) baking. The Collet never reads the raw policy; it reads only the baked values in the Realized Spec.

Promotion Gate The validation and signing pipeline run by the Metrology Lab when mandrel-cli agents promote is called. It validates the spec, applies platform policy baking, checks semantic idempotency, signs the baked spec (compact JWS, alg: EdDSA), and returns a Realized Spec with a status block.

Realized Spec A MandrelSpec that has been processed by a metrology lab’s promotion gate. Structurally identical to a raw spec but with a status block appended (phase, promotedAt, promotedBy) and a top-level signature — a compact JWS covering the entire document except that field. Platform ceilings have been applied and workload references resolved to fully-qualified SPIFFE IDs. A spec is treated as realized when status.phase is approved and the signature verifies. Contrast with the Source Spec authored by developers.

Risk Profile A top-level governance posture declared in a Mandrel Spec (e.g., safety-first, balanced). Determines the system’s default fallback behavior when a governance rule is ambiguous or unevaluable.

Source Spec The human-authored Mandrel Spec stored in version control. Expresses the developer’s intent for an agent’s operational boundaries. It is transformed into a Realized Spec during CI/CD.

Specialist An ephemeral, domain-specific worker agent bound to scoped infrastructure and governed by a specific Mandrel Spec. Invoked by an Orchestrator to perform a discrete task via MCP.

SPIFFE / SVID Secure Production Identity Framework for Everyone (SPIFFE) is a set of standards for workload identity. An SVID (SPIFFE Verifiable Identity Document) is the cryptographic credential — typically a short-lived X.509 certificate — that proves a workload’s identity in the Mandrel mesh via mTLS.

SPIFFE Federation A bundle exchange between two SPIFFE trust domains, without which neither can validate the other’s SVIDs. A spec naming an absolute SPIFFE ID outside its own trust domain asserts that such a relationship exists; a lab rejects one the platform has not federated with, because the rule could otherwise never fire.

Step-Up Authentication (RFC 9470) An OAuth 2.0 mechanism that allows a resource server to require a higher level of authentication mid-session. In Mandrel, the Collet triggers step-up when a request attribute crosses an enforcement matrix threshold, requiring explicit human cryptographic proof before the tool executes.

Token Budget (spec.token-budget) An optional stanza in a MandrelSpec that declares chip-based cost governance for the agent. Specifies a primary-chips limit, a model-id (resolved against the active ChipRateTable), an optional resolution-chips fallback, clamp-points (inbound macro-hold and/or outbound micro-check), and graceful-degradation behavior on exhaustion. Validated by the CLI (E012); the Metrology Lab also enforces L002 if the model-id is absent from the table.

Trust Domain The administrative boundary a SPIFFE identity belongs to, named in the authority position of a SPIFFE ID (spiffe://prod.example.internal/ns/finance/sa/ledger). It is a property of the SPIRE server or CA that issues SVIDs, not of any agent, so it lives in platform policy rather than in an authored spec.

Workload Reference An entry in egress-spiffe-targets or ingress-spiffe-allow-list. Three forms: path-only (/ns/finance/sa/ledger, meaning this deployment’s own trust domain), absolute (spiffe://…, naming a foreign one and asserting federation), and tag (tag:spiffe-auth). A lab resolves all three at promotion time so that enforcement sees only fully-qualified identities.