advatar/get.wauth.plugins

Wallet-credential presentment via the Mandamus Digital-Credentials doorkeeper (Apple Wallet / Digital Credentials API / mdoc / EUDI) — the doorkeeper verifies the presentation (issuer-signed, holder-bound, aud/nonce-bound, unexpired) and issues scoped authority. Reading accepted types free; standard credential → passkey; high-assurance identity / age / KYC / government-ID or failed binding → passkey + iProov liveness; agent never holds the raw credential.

Microsoft Entra identity actions via the Mandamus Entra doorkeeper (directory reads free; MFA reset / privileged role grant → passkey + iProov liveness).

GitHub coding-agent actions via the Mandamus GitHub doorkeeper (protected-branch merges → passkey; force-push / CI-bypass / branch-protection / secrets → passkey + iProov liveness).

Link a payment key to an agent under a Mandamus merchant lock via the Mandamus Link doorkeeper, then pay against it. Reading the instrument free; payment to a known destination within threshold → passkey; new key / new destination / over-threshold → passkey + iProov liveness. Live-vs-sandbox is server-authoritative; the agent never sees the key.

Notion workspace actions via the Mandamus Notion doorkeeper — reads free; create/edit → passkey; delete a database / make a page public / bulk or protected-database writes → passkey + iProov liveness. The agent never holds the Notion token; every action is receipted.

Just-in-time, time-limited SaaS access via the Mandamus SaaS JIT control plane (AFPS) — production grant → passkey; privileged/admin or contained-token mode → passkey + iProov liveness; auto-revoked + reconciled, agent never holds the credential.

Salesforce actions via the Mandamus Salesforce doorkeeper (production writes + protected objects escalate to passkey + liveness).

Stripe actions via the Mandamus Stripe doorkeeper (passkey + iProov liveness for high-risk).

Intent-bound commerce via the Mandamus Verifiable-Intent doorkeeper — the agent presents a signed Verifiable-Intent mandate (merchant, amount ceiling, item, validity) and the doorkeeper verifies the order is inside that envelope under a merchant lock. Reads free; order within the mandate → passkey; over-threshold / new payee / missing-or-invalid mandate → passkey + iProov liveness; agent never holds a payment credential.