No limits
A key or a saved card lets an agent do anything the account can do. Nothing says how much it may spend, with whom, or until when.
Open source · TypeScript · Apache 2.0
v0.5 · ALPHA
Mandates, not full powers.
Plenipo lets AI agents act for you only within limits you approved in your EUDI Wallet, and lets any service verify that mandate before the agent acts.
Plenipo is an open source alpha (v0.5): the code, the specification and the test vectors are public. The cryptography is real, but it has not been tested with a production wallet or audited by an external security firm. Not for production use with real money or data yet.
Get started
npm install plenipoAI agents are getting full powers
AI agents are starting to book, buy and pay on our behalf. Today the only way to let them act is to hand over passwords, API keys or card details: full powers, with no limits and no expiry.
No accountable person
Agent registries can tell which software acted, not who is behind it and with what authority. Services cannot tell an authorized agent from a hijacked one or a prompt injection.
Hard to stop
Revoking a password or a card breaks everything else that depends on it. There is no clean way to withdraw one agent's permission.
Plenipo replaces full powers with a mandate: approved by a verified person in their EUDI Wallet, limited in scope, spending and time, checked by the service before every action, and revocable at any time.
How verifiable agent mandates work
- 01
Approve a mandate in your wallet
Your EUDI Wallet presents your PID, bound to the mandate through OpenID4VP transaction data.
- 02
Your agent acts within scope, limits and expiry
Allowed actions and counterparties, spending limits, an expiry. Sub-delegation can only narrow it.
- 03
Any service verifies before it executes
Through an MCP integration for AI tools or an HTTP gateway for APIs. You can revoke anytime.
The root of every chain is your PID presentation: no new identity, no new root key.
Follow a payment through Plenipo
Pick a scenario and watch the mandate, the agent's request and every check the service runs before anything happens.
Pay €62.40 to City Power. All checks pass.
Pay €140 to City Power. €140 exceeds the €100 per-payment limit the person approved. LIMIT_PER_OPERATION · 403
A malicious web page tells the agent to pay €90 to Quick Refunds Ltd. The agent was tricked, but the payee is not in the mandate. The service refuses whatever the model decided. COUNTERPARTY_NOT_PERMITTED · 403
Pay €62.40 to City Power after revocation. The person withdrew the mandate. The next check sees it on the status list. REVOKED · 401
The same signed request is sent a second time. A request can be used once. Any reservation made for it is released. REPLAY · 409
The answer to a €62.40 payment to City Power is lost, and the agent sends the same payment again. The retry carries the same idempotency key as the first attempt. The service sees the payment already went through and returns its original result: City Power is paid once. ALREADY_EXECUTED · 409
Pay €62.40 to City Power on day 8. The mandate lasted 7 days. There is no grace period on expiry. EXPIRED · 401
Pay €62.40 to City Power
Person · EUDI Wallet
Agent platform
AI agent
Service (a bank) · Plenipo verifier
Status list (revocation)
ActiveExample mandate
Pay household bills · payees: City Power, Aqua Water, Telco One · max €100 per payment · €200 total · expires in 7 days · no sub-delegation
Step 1 of 13
Request a mandate
Mandate request (OpenID4VP). The wallet shows scope, payees, limits and expiry.
Service checks
- Not evaluated: Wallet signature and PID binding
- Not evaluated: Delegation chain only narrows
- Not evaluated: Time window
- Not evaluated: Signed request matches the real call
- Not evaluated: Scope and per-payment limit
- Not evaluated: Status list
- Not evaluated: Atomic spending reservation
- Not evaluated: Nonce: not a replay
Illustrative simulation. Names and amounts are examples.
The flow, step by step
- 01Request a mandate. Mandate request (OpenID4VP). The wallet shows scope, payees, limits and expiry.
- 02Approve in the wallet. Signed PID presentation, bound to the exact mandate through its hash. No new identity, no new keys.
- 03Deliver the mandate chain. Verified mandate chain. Any sub-delegation could only narrow it.
- 04Send the signed request. Signed request: action, payee, amount, audience, fresh nonce, plus the mandate chain.
- 05Wallet signature and PID binding. Trusted issuer, mandate hash matches what the person approved.
- 06Delegation chain only narrows. Delegation chain only narrows.
- 07Time window. Not before start, not expired.
- 08Signed request matches the real call. Request signed by the agent and matching the real call (audience, freshness, action, payee, amount).
- 09Scope and per-payment limit. Action, payee, currency, per-payment limit.
- 10Status list. Person's PID and mandate not revoked.
- 11Atomic spending reservation. Spending reservation within the total, atomic.
- 12Nonce: not a replay. Nonce: not a replay.
- 13Executed. ALLOW. The service executes the payment, commits the reservation and writes a signed audit record.
Built on open standards
- eIDAS 2 / EUDI Wallet
- OpenID4VP 1.0
- SD-JWT VC
- IETF Token Status List
- Model Context Protocol
- EUDI e-mandate · TS12 (experimental)
Roadmap
Plenipo targets aligned to the eIDAS 2 regulatory calendar.
Now · Public alpha (v0.5)
Open source on GitHub and npm. Working library, specification with test vectors, and a full sandbox (simulated bank, wallet and agent platform). Since 0.5, an agent can safely retry a payment whose answer it lost: idempotency keys make sure it runs once. Every release goes through security reviews by independent AI review agents, with all findings fixed; no external audit yet. Tested with a third-party wallet (walt.id), not yet with a production wallet on a phone.
0.5.1 (13 November 2026) fixes the findings of the first CodeQL scan and updates dependencies; the repository now runs CodeQL on every pull request.
December 2026 · Public beta (target)
EU Member States must make the EUDI Wallet available to citizens.
Plenipo goal: first end-to-end tests with real wallets and a public sandbox.
December 2027 · Production-ready 1.0 (target)
Banks, payment institutions and other regulated relying parties must accept the EUDI Wallet.
Plenipo goal: a stable 1.0 for services that need to verify agent mandates.
Dates refer to Regulation (EU) 2024/1183 (eIDAS 2). Plenipo milestones are targets, not commitments.
Open source, Apache 2.0
Plenipo is open source under Apache 2.0. The library, the specification with test vectors and the sandbox are public on GitHub under plenipo-net, and the library is on npm as plenipo. Contributions are welcome.
Plenipo is currently developed by Fabio Lalli, who works on AI adoption and strategy and is a partner in LocalAI, the open source project for local, private AI with real sovereignty.
EUDI Wallet and AI agent mandates: FAQ
What is Plenipo?
Plenipo is an open source TypeScript library that lets a person authorize an AI agent with a mandate approved from their EU Digital Identity (EUDI) Wallet, and lets any service verify that mandate before the agent acts.
What problem does Plenipo solve?
Today AI agents act with passwords, API keys or card details, which give full powers with no limits, no expiry and no proof of who authorized them. Plenipo lets a verified person grant an agent a limited, revocable mandate from their EUDI Wallet, and lets services check it before the agent acts.
What is a mandate?
A mandate is a signed authorization with a scope (allowed actions and counterparties), spending limits and an expiry. The person can revoke it at any time, and any sub-delegation to another agent can only narrow it.
What happens when a request is rejected?
The service stops at the first failed check and returns a precise reason, such as an amount over the limit, a payee outside the mandate, a revoked or expired mandate, or a replayed request. Nothing is executed and nothing is charged, and the decision is recorded in the audit log.
What if the agent loses the answer in the middle of a payment?
It can retry safely. Since version 0.5 every attempt of the same payment carries the same signed idempotency key. If the first attempt went through, the service returns its original result instead of paying again; if its outcome is still unknown, the service refuses the retry until it has checked. A payment runs at most once, even if the agent or its host restarts.
How quickly does a revocation take effect?
Services cache the revocation list for a short time, 60 seconds by default. For calls that move money a service can require a fresher list, down to checking it on every call, so a revoked mandate stops there within the bound the service chooses.
How is this different from giving an agent an API key or a password?
A key gives full powers and says nothing about who is behind the agent. A Plenipo mandate is tied to a verified person through their wallet, is limited, expires, and is checked by the service on every action.
Which standards does it use?
Plenipo uses eIDAS 2 and the EUDI Wallet, OpenID4VP 1.0 transaction data, SD-JWT VC, IETF Token Status List for revocation, and the Model Context Protocol for AI tools. It also supports, as an experimental extension, the EUDI e-mandate type from technical specification TS12.
Is Plenipo ready for production?
No. Plenipo is an open source alpha (v0.5). The cryptography is real, but it has not yet been tested with a production wallet on a device, nor audited by an external security firm.
When will it be available?
It is available now as an open source alpha: npm install plenipo. The target is a public beta with real wallets around December 2026, when EU Member States must offer the EUDI Wallet, and a production-ready 1.0 ahead of December 2027, when banks and other regulated services must accept it.
Is it open source?
Yes. Plenipo is open source under the Apache 2.0 license. The code is at github.com/plenipo-net/plenipo and the library is published on npm as plenipo.
Who is behind Plenipo?
Plenipo is currently a project by Fabio Lalli, who works on AI adoption and strategy. He is a partner in LocalAI, the open source project for running AI locally and privately, for real AI sovereignty. Plenipo is developed in the open and aims to become a community project.
Who is it for?
Plenipo is for developers building AI agents, banks and payment providers, wallet providers and agent platforms that need to know who authorized an agent and within which limits.
Working on wallets, banking or agent platforms?
Plenipo is open to everyone. If you want to pilot it, integrate it or follow its development, leave your details and we will get in touch.