The legal substrate for AI agents acting on a human's behalf.
Every AI agent shipping in 2026 acts on a human's behalf without a signed mandate. Terms of service is not consent. A checkbox is not authority. When the first agent drains a real account, sends a fraudulent message, or releases regulated data, every agent maker, every platform that runs them, and every regulator investigating them will need a single artifact: a verifiable, scoped, revocable mandate, signed by the principal, anchored in law. Civil Code Article 1868 was written for exactly this purpose. It is silent about the agent being human. The FIDNT protocol operationalizes it.
Throughout 2025 and into 2026, AI agents transitioned from research demos to production systems. They draft messages, execute purchases, navigate browsers, file forms, schedule meetings, manage funds, read regulated records, and increasingly take consequential actions on behalf of human principals. The infrastructure for what they can do has matured rapidly. The infrastructure for whether they may do it has not been built.
The current state of agent authorization across the major platforms:
This is not legally durable. A clickthrough is evidence of an offer accepted on a take-it-or-leave-it basis. It is not a mandate; it is not scoped to a specific agent, a specific purpose, or a specific time window; it cannot be revoked with effect; it does not produce a per-action audit record; and in any privacy-rights jurisdiction (DPA 2012, GDPR, DPDPA, LGPD, PIPL, CCPA), it does not satisfy the "specific, informed, freely given, unambiguous" consent standard.
The first time an AI agent causes a material loss, the gap between capability and authority will close in court. Whoever has the legal substrate ready will continue to operate. Whoever does not will be enjoined.
"By the contract of agency a person binds himself to render some service or to do something in representation or on behalf of another, with the consent or authority of the latter." Civil Code of the Philippines · Book IV · Title X · Article 1868
The provision is silent on what kind of person the agent is. The doctrine has historically been applied to:
Article 1868 establishes the relationship; subsequent articles set the requirements. Art. 1874 requires writing for sale of land. Art. 1878 enumerates fourteen acts that require a Special Power of Attorney — the highest tier of mandate. Art. 1881 binds the agent to act within scope. Art. 1920 permits revocation at the principal's will.
Nothing in the agency chapter requires the agent to be human. The chapter requires:
An AI agent satisfies element (2) — capability — by demonstrated function. The remaining four elements are precisely the gap modern AI agents leave open. They are also precisely what the FIDNT protocol issues.
The Data Privacy Act of 2012 (RA 10173) requires consent for the processing of personal information to be "freely given, specific, informed, and unambiguous." RA 10173 § 3(b) The National Privacy Commission's guidance on consent NPC Advisory 2023-01 further requires consent to be demonstrable on demand.
ISO/IEC 27560:2023 — Privacy technologies · Consent record information structure — is the international standard for what a consent record must contain to be machine-verifiable. It defines the fields, the lifecycle events, and the cryptographic anchoring required. FIDNT signs each receipt with ML-DSA-65 (NIST FIPS 204) and anchors it in a SHA3-512 hash-chained, court-admissible ledger.
The fields, paraphrased:
A consent receipt that carries these fields is not a record of an event — it is the event. It is independently verifiable, time-stamped, and survives the failure or hostility of any party. It is what a judge will admit and what a regulator will accept.
An AI agent acting under a FIDNT mandate produces, for every consequential action, a triple: mandate signature (ML-DSA-65, what the principal authorized), action receipt (what the agent did), ledger entry (the SHA3-512 hash-chained audit record). Together, they reconstruct authority, action, and attribution from any point in time, by any party, without trust in the agent or the platform that runs it.
FIDNT exposes the agency rail as six idempotent endpoints that any AI agent platform may call. They reuse the same identity, consent, and audit primitives that FIDNT already provides for human-to-human and human-to-platform agency. Nothing about an AI agent requires a different protocol — only a different declaration of who the agent is.
PRINCIPAL (human)
│
│ signs mandate (Civil Code 1868)
▼
┌────────────────────────────────────────┐
│ FIDNT Mandate Engine │
│ · scope · expiry · revocation URL │
│ · ML-DSA-65 (FIPS 204) signature │
│ · ISO 27560 consent receipt issued │
└────────────────────────────────────────┘
│
│ mandate token
▼
AGENT (AI)
│
│ acts within scope · attaches mandate proof
▼
┌────────────────────────────────────────┐
│ THIRD PARTY (bank · platform · org) │
│ · verifies mandate is live + in-scope │
│ · acts only if verified │
│ · logs action with mandate hash │
└────────────────────────────────────────┘
│
▼
┌──────────────────────────┐
│ RECEIPTS LEDGER │
│ hash-chained · per-user │
│ exportable on demand │
└──────────────────────────┘
| Method | Path | Purpose |
|---|---|---|
| POST | /api/agent/register | Agent registers; receives an agent DID. |
| POST | /api/agent/mandate | Principal signs mandate granting agent scoped authority. |
| GET | /api/agent/verify | Third party verifies mandate is live + in-scope at action time. |
| POST | /api/agent/action | Agent logs an action with mandate proof attached. |
| POST | /api/agent/revoke | Principal revokes agent's authority; webhook fires. |
| GET | /api/agent/audit | Per-principal audit trail of every agent action. |
These primitives are deliberately small. They do not prescribe what the agent does, what model it runs, what platform hosts it, or what jurisdiction it operates in. They prescribe only the shape of authority: scoped, signed, time-bounded, revocable, and accompanied by receipts that survive the parties involved.
Three forces converge in 2026 that make the agency rail unavoidable:
The window for establishing the canonical protocol for AI agency closes during this enforcement cycle. Whoever owns the doctrine, the citations, and the protocol shape during this window owns the category.
If the foregoing argument holds, then the following implications follow:
None of these implications depend on FIDNT specifically. They depend only on the doctrine. FIDNT is the first protocol to operationalize it — chartered, jurisdictionally clear, and ready to integrate.
The six endpoints are documented. The doctrine is published. The mandate engine is wired and running sandbox-grade — real ML-DSA-65 (FIPS 204) signing the moment the production key is set.