Authority infrastructure for AI agents.
Before an AI agent spends money, starts a subscription, shares protected information, delegates work or hires another agent, Quattrino determines what it is actually authorized to do — with your payment rail or ours — and can prove why afterward.
Prefer to read? How it works →
Your AI agent can act. Quattrino decides whether it should — and proves it did.
Standing authority
$50.00 per action
The human said
“Buy a USB-C cable. Keep it under $20. One-time purchase.”
The agent wants to
Within effective authority. In binding mode this would be a single-use authorization.
The problem
A dollar figure alone is not enough information to authorize an agent. Real authority has several dimensions, and the narrowest one wins.
money · task narrows standing
The task instruction is authority too. Quattrino intersects the standing policy with the task: $50 ∩ $20 = $20 effective. $14.99 is AUTHORIZED; $24.99 is DENIED — and the decision names the layer that decided.
commitment · never assumed
A $9.99/month plan is below the $20 ceiling, but “one-time purchase” prohibits recurring commitments. DENIED, commitment_prohibited. Undeclared commitment is never assumed to be one-time: NEEDS_INFORMATION.
data · minimum necessary
Fulfilment needs an address — released once, to that merchant only. An analytics service asking for the same field is refused. Payment secrets, credentials and identity documents are never disclosable.
The decision
Deterministic, replay-resistant, and identical whether Quattrino executes or you do. The demo above returns these from the real engine.
Within the effective authority. In binding mode a single-use authorization is issued: it expires, can be revoked and is consumed exactly once.
Outside the effective authority, a prohibited commitment class, a blocked counterparty or a violated task constraint. Nothing is issued.
A human must confirm — above the autonomous ceiling, an approval rule, or an owner-gated disclosure. The request waits in Approvals; silence never means yes.
The authority to decide does not exist yet. Safe work continues; exactly one precise question goes to the owner, only when the consequential step is imminent.
And every answer explains itself
GET /authorizations/{id}/explain answers who acted, on whose behalf, which layer set the effective authority, what was disclosed, what happened and whether it matched — in plain language and as hashed evidence.
What Quattrino governs
Each dimension is intersected separately: standing policy, compiled task envelope, delegated grant. The most restrictive posture is the one that binds.
Per-action and aggregate ceilings, currency, conditional ceilings (“$1,200 only if RAM ≥ 32 GB”).
One-time · recurring · subscription · auto-renewal · account · contract · warranty · trial-that-converts. Unknown is never one-time.
Per-field posture: release once, redacted, ask the owner, deny — bound to purpose and recipient. Secrets never.
Which merchants, services or agents may be dealt with; attribute requirements (“must grant commercial rights”).
Validity windows, deadlines and expiry for every authorization and every delegated grant.
Whether an agent may hire or delegate, how deep, with what budget — conserved: children never add up to more than the parent.
Approval — the human gate. Anything above the autonomous ceiling, and any disclosure the owner reserved, waits for an explicit decision in one inbox. Approvals expire; silence never means yes.
How it works
01
The human says what they want. Quattrino compiles it into a typed authority envelope — meaning may be inferred, permission never is.
q.compile_intent("Buy a USB-C cable. Under $20. One time.")02
Standing policy ∩ envelope ∩ delegated grant ∩ counterparty ∩ time. The narrowest layer wins, per dimension.
effective = standing ∩ task ∩ delegated03
One call, four answers. Deterministic, replay-resistant and explainable.
q.authorize(amount_minor=1499, merchant="Amazon", ...)04
Use your own rail, or a Quattrino adapter in the sandbox. Quattrino never needs to own the payment to govern it.
execution_plan.execution_mode # "external" | "quattrino"05
Report what actually happened. Amount, counterparty, commitment class, data and delegation are checked against the authorized terms.
q.record_outcome(auth_id, actual_amount_minor=1499, ...)06
Plain-language explain plus hashed evidence: who, on whose behalf, which layer decided, what happened, did it match.
q.explain(auth_id)["plain_language"]Use your own rail
Authorization and execution are separate. Execute with your own provider and report the outcome, or use a Quattrino adapter in the sandbox. Either way the authority layer, the evidence and the compliance check are the same.
Authorize-only. Quattrino issues the decision and the evidence; you execute anywhere and record the outcome.
A single-use token pays the merchant on its own Stripe account. Same authorization layer.
Agent-to-agent services, funded by sandbox Credits, held until delivery.
HTTP-native payments on testnet only. Not expanded in this phase.
Machine payments protocol adapter: card SPT on Stripe test through the official mppx sidecar; stablecoin verification is simulated (provider capability blocked).
Not just money
A project lead holds $300.00 and hires three specialists at $175, $40 and $60. A fourth asking for $50 is refused: only $25 is left to promise. Authority is conserved at issuance — it never multiplies down the tree — and unspent grants return when a child is revoked or expires.
Figures are read from the real delegation engine in the “Delegation conserves” tab of the demo above.
Shipping a cable needs a shipping address: released once, to that merchant, for that order. The same merchant asking for a card number, or an analytics service asking for the address, is refused. Values are never returned by a dry run and never shown on this site; only the decision is.
Try the “Minimum necessary disclosure” tab above — every posture comes from the engine’s disclosure policy.
For developers
Thin SDKs over a single REST contract, plus an MCP server your agent can call directly. No policy logic lives in the client.
from quattrino import Quattrino
q = Quattrino(api_key="qtrn_sk_...") # the agent's scoped credential
r = q.authorize(amount_minor=1499, merchant="Amazon",
purpose="USB-C cable", task={"max_amount_minor": 2000,
"prohibited_side_effects": ["subscription"]})
r.decision # AUTHORIZED
r.effective_maximum_minor # 2000 <- standing $50 narrowed to $20Safety & explainability
Fail closed
If a dimension cannot be checked, the answer is not AUTHORIZED. Ambiguity never expands authority.
Single-use, expiring, revocable
A binding authorization is consumed exactly once; changed amount, merchant, commitment or agent fails the consumption guard.
Conserved delegation
A child grant can never exceed what the parent still holds; unspent authority returns on revoke or expiry.
Evidence, not logs
Material terms, pipeline, outcome and mismatch flags are hashed and explainable in plain language.
Tenant isolation & idempotency
Every record is organization-scoped; every binding call carries an idempotency key, so a retry can never authorize twice.
Immutable envelopes
Every envelope version is append-only with provenance. Agents may only narrow; only the owner widens.
What is real today
Nothing simulated is presented as production. Live settlement is gated off platform-wide until providers, reviews and pricing are approved.
Straight answers
Sandbox
Run authorize, compile an intent, inspect the effective authority and read the explanation. Nothing executes and nothing is billed.
Open the playgroundEarly access
Open signup, no invite. Inside the app you can ask to be told when production onboarding opens and say what you are building. Developer preview: sandbox only, pricing not activated.
Start building