The questions a new category raises.

Agent Accountability is the third layer of agent infrastructure: identity (Know Your Agent) says WHO an agent is. Governance manages HOW it is operated. Agent Accountability proves THAT it was allowed to act — with machine-readable mandates, a runtime check before the action, and a tamper-evident log of every decision. Mandact named and built this category.

The agent picks up one new habit: before every critical action it asks Mandact «may I?» — an API call with its key and its mandate number. The rules (limits, counterparties, thresholds) live exclusively at Mandact; the agent never sees them and therefore can neither forget, circumvent, nor rewrite them. When the responsible person changes a rule in the dashboard, it applies from the next question onwards — no deployment, and nobody touches the agent's code.

Mandact does not remote-control the agent — there is no line from Mandact to the agent. The emergency stop freezes the mandates atomically; from the next question onwards the agent gets a no with a reason for everything (MD-206). The agent may keep running, but it no longer has any effect, because its own code does not proceed without a yes. The freeze itself is recorded in the evidence chain too.

Because the law has a say. The Mandact action catalogue covers 123 action types across four jurisdictions (CH, DE, AT, IT) together with their form requirements: cancelling a subscription is form-free and executable; a German lease or employment termination requires a human signature (the agent only prepares it, reason code MD-404); a notarial deed can never be done by an agent (MD-405). The system enforces these limits at runtime — and states them already when the mandate is created.

No — that is the whole point. Every receipt is ES256-signed; the public verification key is at /.well-known/jwks.json. At mandact.com/pruefen your browser recomputes the check itself, without the receipt ever leaving the page. The evidence chain behind it is hash-chained per organisation and bound to timestamps: altering, removing, or reordering shows up mathematically.

The EU AI Act applies in stages: further duties (including transparency under Art. 50) have applied since 2 August 2026; the high-risk duties were postponed by the Digital Omnibus (May 2026) — to 2 December 2027 for standalone systems under Annex III and 2 August 2028 for systems embedded in regulated products under Annex I. For high-risk systems the Act then requires, among other things, automatic logging, documented human oversight, and the ability to stop a system. Mandact provides controls and receipts that can support such governance duties depending on the system and its use: evidence-only as an entry point (witnessing without intervening), then enforcement, plus the readiness report. Mandact is technical infrastructure — not legal advice, not a certificate of conformity, and no product makes an AI system 'AI Act compliant' by itself.

The smallest entry point is one line: sdk.witness() records an agent action in the evidence chain without blocking anything. Enforcement is about five lines around the critical step (ask, wait for allow, stop on deny). For MCP-capable agents the question comes as a ready-made tool, for platforms like n8n as copy-paste nodes — the connector catalogue increasingly turns this into clicks rather than code.

Four things, stated openly: first, Mandact only stops agents that ask — which is why the gate belongs on the path there is no way around. Second, Mandact is deliberately fail-closed: if it is unreachable, critical actions stand still. Third, in single-party operation the chain evidences compliance with your own rules — diligence, not automatic innocence towards third parties. Fourth, the category is young in the courts; the assessment of evidence remains free. The complete list is at /vertrauen.