What we mean by a named human sponsor
Every agent in Mandavo is bound to an accountable person. Not a team, not a rotation, not a role. A person. Here is why we drew the line there.
Accountability does not scale to groups
When an agent does something surprising, the first question is always 'who owns this'. If the answer is a team, the real answer is nobody. Shared ownership is how orphaned service accounts happen: everyone assumes someone else is watching.
So we require a named individual for every agent. When that agent requests a sensitive scope, an actual person's name is attached to the decision. Audit stops guessing and incident response starts with a phone number.
Sponsors move; accountability doesn't lapse
People change teams and leave companies. A sponsor model that breaks when someone resigns is theatre. Reassignment is a deliberate, logged action in Mandavo — an agent cannot quietly outlive its sponsor.
If a sponsor offboards without handing over their agents, those agents surface immediately as unsponsored and lose the ability to escalate. The gap becomes visible instead of becoming a backdoor.
- #accountability
- #governance
- #sponsorship
More field notes
The 80:1 problem: machine identity is now the perimeter
For every human on your team there are roughly eighty machine identities acting on their behalf. Almost none of them have an owner. That ratio is the whole security problem.
Daniel Osei · Security Engineer
6 min read
Short-lived credentials, in practice
Everyone agrees keys should expire. Then someone sets the TTL to a year so nothing breaks. Here is how we make minutes-long credentials survive contact with real workloads.
Priya Nandakumar · Head of Platform
7 min read
Revocation in 4.2 seconds: anatomy of a containment
We measured the path from anomaly to full revocation across every system an agent could reach. This is where the seconds go, and why they matter.
Daniel Osei · Security Engineer
8 min read