# authorize

URL: /business/nouns/mandate/authorize · Id: `verb:Mandate.authorize` · Call: `await $.Mandate.authorize({ … })` (SDK) or the `do` tool at `https://api.sb/mcp`. Inputs says what to pass, Outputs what returns, When it waits who approves.

> Authorize grants an Agent a standing Mandate to perform a Verb within a Limit, without asking each time.

Authorize grants an [Agent](/business/nouns/agent) a standing [Mandate](/business/nouns/mandate) to perform a [Verb](/business/nouns/verb) within a [Limit](/business/nouns/limit), without asking each time.

## Inputs
| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `agent` | [Agent](/business/nouns/agent) | Yes | The agent that receives the Mandate. |
| `verb` | `string` | Yes | The Verb it covers, as `Noun.verb`. |
| `limit` | [Limit](/business/nouns/limit) | Yes | The bound the Mandate holds to. |
| `for` | [Party](/business/nouns/party) | No | The person the agent acts for, under delegation: the principal and author of record. |
| `channels` | list of [Channel](/business/nouns/channel) | No | The Channels it may send through. |
| `topics` | `string[]` | No | What it may send about; a send outside them becomes an Approval. |
| `approve` | `json` | No | The approval rule for one-way sends, such as the first 20 waiting for an Approval. |
| `window` | `string` | No | The delay window each one-way send waits, as a duration. |
| `expiresAt` | `datetime` | No | When the Mandate lapses. |

## Outputs
| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `mandate` | [Mandate](/business/nouns/mandate) | Yes | The active Mandate. |

## Effects
- Emits [`Mandate.authorized`](/business/events/Mandate.authorized).
- Performed by the [Treasurer](/agents/finance/treasurer).
- One-way (money): it waits out its delay window, and runs in the `send` and `do` modes.
- Never widens a Permission past the authorizer’s own.

## Refuses when
| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The input does not match the schema of the operation. | [`invalid-input`](/code/api/errors/invalid-input) | Read the schema of the operation, then send every required field with the right type. | [Mandate.authorize](/business/nouns/mandate/authorize) |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | [Mandate.authorize](/business/nouns/mandate/authorize) |

## When it waits
| Gate | Default |
| --- | --- |
| Decision class | Medium: one-way, bounded (money) |
| [Delay window](/systems/trust-and-governance/controls/one-way-windows) | 1 business hour, in which a watcher can pause, redirect or cancel it; then it runs. |
| Limit | The spend [Limit](/business/nouns/limit) of the [Permission](/business/nouns/permission) or [Mandate](/business/nouns/mandate) it runs under. |
| Over the Limit | It waits `pending` for an [Approval](/business/nouns/approval) from the [Founder](/agents/founding/founder). Approved, it runs; refused, it ends `refused` with [`limit-exceeded`](/code/api/errors/limit-exceeded); unanswered by its deadline, it ends `canceled`. |

## Example

**Ask**

```text
Authorize the latest mandate with an agent and a limit.
```

**API**

```bash
curl -X POST https://api.sb/ledgerlark.com/mandates/authorize \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent":"agent_1","verb":"Example verb","limit":"limit_1"}'
```

```json
{
  "api": "https://api.sb/ledgerlark.com",
  "mandate": {
    "$id": "https://api.sb/ledgerlark.com/mandates/mandate_1",
    "$type": "Mandate",
    "expiresAt": "2026-10-22T12:00:00Z",
    "status": "active"
  },
  "action": {
    "$id": "https://api.sb/ledgerlark.com/actions/action_1",
    "operation": "Mandate.authorize",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/ledgerlark.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const mandate = await $.Mandate.authorize({ agent: 'agent_1', verb: 'Example verb', limit: 'limit_1' })
```

**CLI**

```bash
npx startup-builder do Mandate.authorize --json '{"agent":"agent_1","verb":"Example verb","limit":"limit_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Mandate.authorize({ agent: 'agent_1', verb: 'Example verb', limit: 'limit_1' })"
  }
}
```

Next: [`Card.issue`](/business/nouns/card/issue) (in `guide:issue-a-card-with-a-limit`).

Guides that call it: [Issue a card with a limit](/systems/finance/issue-a-card-with-a-limit), [Let the support agent refund up to $50](/agents/let-an-agent-refund), [Let the contracts agent sign NDAs](/agents/let-an-agent-sign-ndas).