Skip to main content

Governance Playbooks

Playbooks are copy-paste recipes for governing a real AI agent. Where the Academy explains why delegated authority matters and the Sandbox lets you feel how a decision is made, a playbook gives you an opinionated starting point you can adapt to a production account in an afternoon.

Each playbook follows the same shape:

  1. The scenario — who the agent is and what it should be able to do.
  2. The risk — what goes wrong without a bounded mandate.
  3. The mandate design — a concrete principal, delegate, action scope, resource scope, and constraints.
  4. Create it — the real @mandaitor/sdk createMandate call.
  5. Enforce it — the verify call to place inside the agent's tool handler.
  6. What should be denied — least-privilege test cases you can paste into the Sandbox.
  7. Evidence & review — what to keep and who reviews it.

The playbooks​

PlaybookPatternBest for
Customer-support copilotWrite actions with value limits + human reviewSupport, billing, account-management agents
Data-analyst agentRead-only least privilege (deny all writes)Analytics, reporting, and research agents
Deployment agentTiered approval (auto for low risk, human for high)DevOps, release, and infrastructure agents

Before you start​

You need a Mandaitor tenant and an API key — see Getting Started. Every playbook assumes a client initialized once:

import { MandaitorClient } from "@mandaitor/sdk";

const mandaitor = new MandaitorClient({
  apiKey: process.env.MANDAITOR_API_KEY,
  tenantId: "tnt_your_tenant_id",
});
Adapt, don't copy blindly

The identifiers below (acme:...) use a placeholder namespace. Replace them with your own subject and resource conventions. The shape — narrow actions, a bounded resource pattern, and meaningful constraints — is the part to keep.

The one rule every playbook follows​

Grant the least authority that still lets the agent do its job, then let Mandaitor deny everything else at runtime. A good mandate is boring: a short list of specific actions, a tight resource pattern, and a constraint that forces a human into the loop when the stakes are high. If you can describe the mandate in one sentence, you have probably scoped it well.