Home Assistant: decide what AI agents may do

Home-Mandate for Home Assistant sits between your AI agents and your home. For every device and action it decides: allow, ask or deny – with approval on your phone, an emergency stop and a tamper-evident log.

First version

This is the first version of Home-Mandate for Home Assistant. Read the limits of this version(opens another website in a new tab) and keep backups.

Why a token is not enough

An AI agent that holds a Home Assistant token can do everything that token can: unlock the front door, disarm the alarm, open the garage. A prompt injection in an e-mail or a web page the agent reads is enough to make it try. Exposing devices to assistants only knows on or off – no time windows, no limits on values, no confirmation before an action.

Home-Mandate keeps Home Assistant’s credentials to itself. Every agent gets its own identity and its own mandate, and every request is decided by fixed rules outside the language model – so no agent can talk itself into more. Why mandates?

How it works

The agent asks It connects over MCP and signs in with OAuth 2.1. It never sees a Home Assistant token.
The mandate decides Home-Mandate looks up the device and evaluates the agent’s mandate: allow, ask or deny.
You confirm With ask, your phone shows Allow and Deny in the Companion app. No answer means no.
Home Assistant carries out Only an allowed or confirmed action reaches Home Assistant. Everything lands in the audit log.

The decision is made by the reference evaluator of the Home-Mandate Specification, never by a language model. What is not allowed is denied. Devices an agent may not read do not exist for it: they are neither listed nor named in errors.

Example: a first mandate

A mandate for a voice assistant that helps around the house could look like this. Home-Mandate brings three templates to start from.

Allow

Switch lights in the living room and kitchen
Read temperatures and window sensors
Set the heating, to 22 °C at most

Ask first

Unlock the front door
Open the garage

Deny

Disarm the alarm
Anything not named in the mandate

Try it without installing anything

In the playground you write a mandate and see right away which requests it allows, asks about or denies.

Open the playground

What you can decide

Allow, ask or deny per device, area, category and action – with time windows, weekdays, value limits (brightness, temperature, position, volume) and a limit on actions per hour.
Critical actions – unlocking, opening a gate or garage door, disarming the alarm, running scripts, camera snapshots – need an approval even where a rule allows them, unless the rule says otherwise explicitly.
Approval requests go to the phones of the people you choose, through the Home Assistant Companion app.
An emergency stop halts every agent at once; single agents can be revoked.
Every decision, approval and change is written to a hash-chained audit log with signed checkpoints.
Agents get short-lived tokens bound to Home-Mandate; no agent is admitted without a Home Assistant administrator.
Web UI in English and German, in the Home Assistant sidebar; administration on the command line as well.

Installation

Check the requirementsHome Assistant OS 2026.9 or later on amd64 or aarch64 – or Home Assistant Container with Docker or Podman Compose. The Companion app on the phone of everyone who should answer approval requests.
Install Home-MandateOn Home Assistant OS, add the repository below in the app store (Settings → Apps → App store → ⋮ → Repositories) and install Home-Mandate. With Home Assistant Container, run it with the Compose file next to Home Assistant.
Set up approvers and a mandateChoose who answers approval requests, mark critical devices and start from one of the templates.
Connect your first agentClaude Desktop, Claude Code, claude.ai, ChatGPT or another MCP client signs in; a Home Assistant administrator admits it and picks its mandate.

The repository for the app store:

https://github.com/home-mandate/ha-home-mandate

Step by step: Home Assistant OS(opens another website in a new tab), container mode(opens another website in a new tab), first steps(opens another website in a new tab) and connecting agents(opens another website in a new tab).

Reaching it from outside

Most agents do not run in your home network, so they need to reach Home-Mandate over HTTPS. Home-Mandate speaks TLS 1.3 only. On Home Assistant OS it uses a certificate in /ssl, for example from the Let’s Encrypt or DuckDNS app, and needs a TLS passthrough or a port forward.

In container mode, Home-Mandate can also run behind your own reverse proxy: there are guides for Traefik, nginx, Nginx Proxy Manager and Caddy(opens another website in a new tab).

Conformance

Home-Mandate for Home Assistant embeds the reference evaluator of the specification and runs its conformance cases on every change. Which version and which classes it passes is in the list of implementations, checked against the published reports.

Questions

Which AI agents work with it?

Every agent that speaks MCP over HTTPS and signs in with OAuth 2.1 – for example Claude Desktop, Claude Code, claude.ai and ChatGPT. Clients without browser sign-in can pair with a code.

#which-agents

Does it replace exposing devices to Assist?

No. Assist keeps working as before. Home-Mandate is the way in for AI agents that should not hold a Home Assistant token – with rules per agent instead of one list for all.

#assist

Is this part of Home Assistant?

No. Home-Mandate for Home Assistant is an independent open-source project and implements the open Home-Mandate Specification. It uses Home Assistant’s public interfaces and asks nothing of Home Assistant itself.

#official

What about openHAB, ioBroker or other platforms?

The specification is open to every platform. Implementations for other platforms are welcome and appear in the list of implementations.

#other-platforms

Home-Mandate for Home Assistant is licensed under AGPL-3.0-or-later. Source code, releases and issues: github.com/home-mandate/ha-home-mandate(opens another website in a new tab).