Provider-mandate census for agent credentials

Google's is_agentic flag must be set on every OAuth client your agents use by November 11, 2026 — and on November 12 the setting locks permanently, so a miss means a new client ID, new consent screens, and re-wiring every MCP config and n8n credential that referenced the old one. Google's own notice is one email per project; nobody joins your whole estate together. This census does: it joins your Google Cloud OAuth client lists against your actual MCP config files and n8n credential exports, classifies every client agent-used / human-only / mixed from the surfaces that really reference it, and returns a signed verdict per client — FLAGGED, UNFLAGGED-AGENT, MIXED-SPLIT-REQUIRED, UNFLAGGABLE-IN-PLACE (the Apps Script shape no console can flag, with its workaround), or LOCKED with the rebuild plan. A partial census can never pass as a clean one: any gap flips it to INCOMPLETE, signed. Proven in the lab: 16/16 tests, every verdict class exact on a 10-client estate, a 1,000-client census in 293 ms.

Timing, plainly (pre-enforcement): Timing, plainly: buy before ~Nov 6 to leave time to flag, split, or rebuild before the Nov 11 enforcement; the setting locks permanently Nov 12.

Prices

• Census $29 one-time per operator — all projects/configs under one operator, one signed verdict per client, hash-linked audit chain. A single-client check is free, one time per operator (the trial grant).
• Mandate Watch $9/mo per operator — standing watch for new provider mandates, plus one re-census of your stored estate each time a new mandate record is detected. Watch does not include arbitrary censuses; those use a Census credit or the per-census API.
• Per-census API $5.00/census (x402, Base USDC) — one census + verdicts, agent-self-audit form; no account needed, the verified payment is the credential for the call.

Start

POST /register {"operator": "your-name"} → per-customer token (shown once). POST /trial claims the one-time free single-client check. POST /buy-census with a verified $29 x402 payment adds one census credit. POST /subscribe {"plan": "watch"} with a verified $9 x402 payment starts Mandate Watch. POST /census with your estate (clients + surfaces) runs the census: trial (single client) → census credit → $5.00 x402, in that order. POST /adapters/gcp fetches your OAuth client lists with YOUR OWN Google access token (sent in the X-Provider-Token header, read-only, never stored or logged); POST /adapters/n8n reads your live n8n credential store with your own API key; exporting the same shapes and submitting them as surfaces to /census remains the fallback. MCP JSON-RPC at POST /mcp (tools: mandate_census, mandate_list, mandate_verify, mandate_watch_status). Machine docs: /openapi.json, /llms.txt, /.well-known/x402, verdict signing keys at /verify-key, terms at /terms, privacy at /privacy.

Limits (stated plainly)

• Verdicts classify from referencing surfaces only. The product does not set the provider flag, split a client, or rebuild a credential for you — remediation (flag / split / rebuild, per the verdict's stated plan) remains your action in the provider's own console.
• A census marked INCOMPLETE is never represented as compliant: any malformed surface or any reference to a client missing from the provider list flips the whole census to INCOMPLETE, inside the signed result.
• Secret-shaped values in submitted artefacts are dropped before processing and only counted (secrets_dropped); they are never stored, hashed, logged, or emitted.
• The GCP adapter uses your own per-census authorization and is read-only; per-project adapter failures are reported in adapter_errors, never silently dropped. The founding census at ship time ran the production build against the lab's 10-client fixture estate (every verdict class exact) — TextForAgents LLC itself operates no GCP OAuth clients, so there was no house OAuth estate to census; that fact is recorded in the ship record, not hidden.
• Mandates are data: the founding record is Google's is_agentic mandate (enforcement 2026-11-11, lock 2026-11-12). New provider mandates enter through the Mandate Watch feed as new records, not code changes; a census may also carry its own mandate record.
• After 2026-11-12 the same census sells the LOCKED verdict + rebuild plan, and Mandate Watch becomes the standing product — the switch is driven by the mandate's own dates.
• Lost-token recovery is a manual step via support@textforagents.com.

Support: support@textforagents.com · Provider: TextForAgents LLC