In everyday life
What a mandate does for you even when nobody is attacking you – and why your smart home app alone is not enough.
Isn’t my smart home app enough?
Your smart home app is built for people you trust: you and your family. AI agents are different. They act on their own, come from other vendors and can be tricked. You give a family member a key. You tell a tradesperson: “Kitchen yes, bedroom no, until 5 pm – and ring first.” That is exactly what a mandate is.
Who may act?
Smart home app todayAn agent gets access like a person – or every agent sees the same exposed devices.
With a mandateEvery agent has a mandate of its own.
What exactly?
Smart home app todayA device is exposed or it isn’t.
With a mandateSingle actions: switching a light on yes, unlocking a door no.
How far?
Smart home app todayOnce the heating is exposed, any temperature goes.
With a mandateWithin limits, for example 22 °C at most.
When?
Smart home app todayAlways.
With a mandateOnly at the times and on the weekdays you choose.
Ask first?
Smart home app todayIf at all, the agent asks itself – the very program that can be tricked.
With a mandateYour home asks you on your phone. Without an answer, nothing happens.
Afterwards?
Smart home app todayThe logbook shows that the light went on.
With a mandateThe log shows which agent wanted what – including what was denied. It cannot be changed later without it showing.
Another vendor?
Smart home app todayThe rules only apply in this app.
With a mandateAn open standard: any agent and any platform can implement it.
A mandate does not replace your smart home platform – it sits in front of it. The platform carries out; the mandate decides beforehand whether an agent may do it at all. For Home Assistant there is Home-Mandate for Home Assistant; any other platform can implement the specification just as well.
For technicians: how is this in Home Assistant today?
Devices are exposed to voice and AI assistants per device, on or off. Every AI assistant that connects through Assist or the MCP server sees the same exposed devices. There are no time windows, no limits on values and no confirmation before an action is carried out.
Applications without OAuth use long-lived access tokens, valid for ten years. A confirmation before a tool call is asked, if at all, by the AI client itself. As of October 2026. Home-Mandate for Home Assistant adds all of this.
Six examples
Each example is one rule as it appears in a mandate – in plain words instead of JSON. How a mandate is checked
Your energy app should save heating costs while you are on holiday.
Once the heating is exposed, the app can also turn it up to 28 °C – by mistake or by a trick.
“The energy app may set the temperature, to 22 °C at most.”
allowTurning it down works at once. Your home refuses 28 °C.
The voice assistant in the children’s room may switch the light and play music.
Exposed is exposed – at midnight too.
“Music in the children’s room: yes, but only between 7 am and 8 pm.”
denyAt 9 pm it stays quiet. The light still works.
An agent wants to unlock the front door for the courier.
Either it may open doors – then at any time and without you – or not at all.
“Unlock the front door: only after I confirm on my phone.”
askYou tap Confirm. Without an answer, the door stays locked.
You try out a new AI assistant.
It sees everything exposed to assistants right away.
“A new agent may do nothing until I give it a mandate.”
denyIt may do exactly what you allow – and not one switch more.
Because of a bug, an app switches the light every second.
It keeps switching until someone notices.
“This agent may carry out at most 10 actions per hour.”
denyAfter the tenth, it stops. An emergency stop halts every agent at once.
At three in the morning the hall light goes on.
The logbook says that it went on – not who wanted it.
“Every request is written down with agent, time and decision.”
The log says: voice assistant, 3:12 am, hall light on, allowed.
In the playground you build a mandate with a few clicks and send requests against it – no installation, right in your browser.
Open the playground