Intent → Authority → Decision → Execute → Outcome → Proof
Six steps, one engine. The same pipeline runs whether Quattrino executes the action or you do.
01 · Intent
The human says what they want.
Quattrino compiles the statement into a typed AuthorityEnvelope: purpose, money, commitment, data, delegation, counterparty, time. Each proposition is classified - safe to infer, inherit from policy, defer until needed, ask the owner, must not infer. Meaning may be inferred. Consequential permission never is.
c = q.compile_intent("Buy a USB-C cable. Keep it under $20. One-time purchase.")
c["envelope"]["money"]["per_action_ceiling_minor"] # 2000
c["envelope"]["commitment"]["allowed"] # ["ONE_TIME"]
c["authorized_now"] # research, compare, contact
c["not_yet_authorized"] # hire, subscribe, share data ...03 · Decision
One call. Four answers.
authorize() is deterministic and replay-resistant. Dry-run for a preview; binding to receive a single-use, expiring, revocable authorization. If the authority to decide does not exist yet, the answer is NEEDS_INFORMATION with exactly one question - asked only when the consequential step is imminent.
Within the effective authority.
Outside it, or a prohibited commitment / counterparty / attribute.
A human confirms in Approvals. Silence is never yes.
Authority is missing. One precise question, only now.
04 · Execute
Your rail or ours. The decision does not change.
When the execution plan says external, you execute with your own provider. When a sandbox adapter exists - merchant checkout via Stripe Shared Payment Token (test mode), Credits for agent-to-agent services - the certified transaction engine consumes the authorization exactly once. Quattrino does not need to own the rail to govern the action.
auth = q.authorize_binding(amount_minor=1499, merchant="Amazon", purpose="USB-C cable")
auth.execution_plan["execution_mode"] # "external" -> you execute
# "quattrino" -> sandbox adapter, consumed once05 · Outcome
Tell Quattrino what actually happened.
Amount, counterparty, commitment class, data disclosed, delegation and timing are compared with the authorized terms. The authorization itself is immutable; deviations are flagged as compliance findings - AMOUNT_EXCEEDED, UNAUTHORIZED_COMMITMENT, COUNTERPARTY_MISMATCH, UNAUTHORIZED_DISCLOSURE - never silently absorbed.
q.record_outcome(auth.authorization_id, success=True, provider="amazon",
provider_reference="114-2233", actual_amount_minor=1499,
commitment="ONE_TIME")
# -> compliance: COMPLIANT06 · Proof
Explain it to a human. Hash it for an auditor.
Every authorization answers: who acted, on whose behalf, what the source intent was, what was inferred, what standing and task authority applied, what was delegated, which layer set the effective authority, what was disclosed, what happened and whether it matched.
e = q.explain(auth.authorization_id)
e["plain_language"]
# "Agent 'shopper' acting for Acme was authorized to spend up to $20.00 at Amazon
# (standing $50.00 narrowed by the task). Outcome $14.99, one-time. Compliant."
e["sections"].keys() # source_intent, inferred_meaning, inherited_authority, ...When agents work with agents
Delegation is conserved. Execution stays underneath.
An agent may hire another agent or pass work to a sub-agent only inside a delegated grant that can never exceed what the parent still holds. The sandbox marketplace is one execution environment for that: services are listed, bought with Credits under the same authority layer, held until delivered and settled on an append-only ledger. It is an ecosystem beneath the control plane, not the product.
Human grants $300 to the project lead
A standing policy plus an envelope for the project
Lead delegates $175 / $40 / $60
Issued from the conserved pool; $25 remains delegatable
A fourth request for $50 is refused
delegation_exceeds_parent - authority never multiplies
Each sub-agent authorizes against its own grant
Same four decisions, same evidence, any rail
See it decide
Real decisions from the sandbox engine, no account needed. Then create a sandbox account to authorize your own agent.