Security & trust

Deterministic authority

Language models help compile intent and write explanations. They never decide money, data, commitments or delegation. Every decision is produced by deterministic policy, envelope, delegation and approval logic.

Fail closed

If a dimension cannot be checked - no standing authority, an undeclared commitment, an unknown counterparty - the answer is not AUTHORIZED. Ambiguity never expands authority.

Narrowing only

A task, an envelope or a delegated grant can only reduce what the standing policy allows. Agents may narrow their own envelope; only the owner may widen it, and every version is append-only with provenance.

Single-use binding authorizations

A binding authorization expires, can be revoked and is consumed exactly once. Changing the amount, merchant, commitment class or agent fails the consumption guard.

Conserved delegation

Children never add up to more than the parent holds. Issuance is atomic; unspent authority returns when a child is revoked or expires.

Purpose-bound disclosure

Protected fields are released only for a necessary purpose, to a named recipient, once. Payment secrets, credentials and identity documents are never disclosable. Dry runs never return values.

Agents are isolated

Buying a service never grants access to another agent’s memory, credentials, prompt, files, tools or organization. A bidirectional firewall runs on every message.

Least-privilege access

Agents hold a scoped, revocable credential - never a card, a login or a master key. Resource access is a time-limited grant for exactly the approved operations.

Payment credentials stay with the provider

Card details are tokenized and held by the payment provider (Stripe, test mode). No agent, and no model, can read them.

Idempotent, never twice

Every binding call and every execution carries an idempotency key; a retry can never authorize or charge twice. Uncertain provider outcomes are reconciled, not retried blindly.

Untrusted by default

Merchant pages, MCP tools, agents and service content are treated as untrusted input. Injected instructions are flagged and never override deterministic authority.

Tenant isolation

Every record is organization-scoped. One organization can never read or modify another’s agents, policies, envelopes, authorizations or evidence.

Append-only evidence and ledger

Authorizations, outcomes and compliance findings are hashed and immutable; sandbox money lands on a double-entry ledger. Corrections add entries - history is never edited.

Human emergency controls

Freeze all agent activity with one switch, revoke a credential or an authorization, suspend a service or disable a provider - without a deploy. Every emergency action is itself audited.

Payments

Stripe (test mode)

Tokenizes and holds card details; settles sandbox merchant checkout. Live mode is gated off platform-wide.

AI models

Model providers via a universal key

Classification and explanation only. Never final authority over money, access or permissions.

Email

Transactional email provider (operator-configured)

Verification, approval requests, authority questions, security notices. Nothing is sent without a verified sender configuration. Secrets are never emailed.