Error reference: Agent and principal
Do all parts name the same agent, is the principal named, does the agent hold the bound key?
This check links the acting agent with its principal. It checks whether a mandate or other evidence names both, and whether the agent that acts is the same as the one in the evidence, for example through the key in the key binding.
Without this binding, it remains open on whose behalf an agent acted, even if all signatures hold.
agent_mismatch
The parts of the evidence name different agents.
Cause: The acting agent is not the same as in the evidence, for example because the key in the key binding does not match the mandate or decision and mandate name different agents.
Fix: Present the evidence of the agent actually acting. Check whether an agent is using someone else's mandate.
principal_missing
The principal is not named.
Cause: The evidence names no principal.
Fix: The mandate must name the principal unambiguously. Add the claim at issuance.
agent_missing
The agent is not named.
Cause: The evidence names no agent or binds no agent key.
Fix: Bind the mandate to the agent's key, for example through the cnf claim, so that only this agent can present it.
no_credential
No mandate and no agent passport present.
Cause: There is no evidence linking agent and principal, for example only a decision without a mandate.
Fix: Include the mandate or an agent passport, most simply as an evidence pack.
credential_is_not_a_mandate
The presented credential is not a mandate.
Cause: The evidence presented is not a mandate, for example an agent passport. It proves the agent's identity, not its authority.
Fix: For actions with consequences, also present a mandate with limits.
Common situations
Only a decision: if only the decision is verified, the mandate linking agent and principal is missing. Present mandate and decision together, most simply as an evidence pack.
Agent passport instead of mandate: an agent passport proves who the agent is, but not on whose behalf and within which limits it may act. Actions require a mandate.
New agent key: if the agent's key was rotated, the key binding no longer matches the mandate. Issue the mandate anew for the new key.
How to test this check
Verify a single decision without the related mandate, for example from the public test vectors. The check then reports that no evidence links agent and principal. With the complete pack, it becomes valid.