Spec 3.8.1.1 seems pretty unambigious to me on setting the property.
It is worth noting, that there are actually two different isMandatory flags in play:
The one passed in the MessageInfo arguement to SAM.validateRequest tells if this particular request is accessing a protected resource, while the other is passed to SAM.initialize in the requestPolicy argument, that is analogous to the JAAS auth module required/optional flag.