Core

Governance

Everything between deciding and settling, and everything that happens when a decision turns out to have been wrong.

Settle separation

The caller never holds the means to settle. An agent submits an instruction; the decision and the settlement both happen on the other side of a boundary it cannot reach. This is the property everything else here depends on, and it is why hosted signing exists as its own thing: you can have keys managed for you without the separation collapsing.

People in the loop

Approval: An outcome of confirm parks the instruction. A person releases it with a separate operator credential, and the original terms are what settle.
Hosted signing: Keys can be held for you without the separation collapsing. The gate issues a short-lived attestation bound to one approved instruction, committing to the whole instruction rather than just to a key, and only ever on allow — a confirmis not an approval. Reconciliation replays the backend's own log and reports any signature that has no attestation, so misuse of a hosted key through its own API is detectable and not merely forbidden.
Observe versus act: An authority split, so a system can be given the right to watch without the right to move anything.
Oversight: The measurement layer around all of it: what was approved, how quickly, and how often approval is a formality rather than a decision.

Time as a control

Settlement delay: A delay scaled to value, so that revocation is actually reachable before the money is gone. A right to revoke that expires before anyone notices is not a right.
Revocation: Identity-scoped, using a published status list, so a withdrawn authority is withdrawn everywhere rather than only where we were asked.
Authorise now, capture later: Hold the authority and take the money afterwards, for the cases where the amount is not knowable at the point of agreement.

When it goes wrong

Dispute: A governed lifecycle that runs before a payout, rather than a support ticket after one.
Refund: Operator-authorised reversal, with a rationale that lands in the record.
Kill switch: Freeze settlement. Engaging and releasing are signed as distinct operations, so one cannot be replayed as the other.
Circuit breakers: Automatic halts, cleared deliberately rather than by waiting.

The parameters, and where they are set

Every bound below is a number an operator sets, and every one of them can only tighten a decision. None of them can grant authority the mandate did not already carry.

Concentration: A ceiling on how much of a budget any one counterparty may absorb, as an amount or a share, plus a floor on how many effective counterparties there are. The share is measured against the period cap rather than against what has been spent, so reordering payments cannot change a verdict.
Adaptive caps: Four inputs that make the effective ceiling a function of standing: how fresh the evidence is, how far behaviour has drifted from what was declared, whether spend converts to value, and what kind of claim the asset is. Freshness decays exponentially, with spot re-audits that can lower a tier and never raise one. An asset that is neither at par nor redeemable is a hard veto.
Credit: An underwriting standard with a minimum history, a maximum share from any one counterparty, a maximum self-dealt share, an advance rate and a haircut. Advances round down and deductions round up, both against the borrower. Standing moves on a ratchet: a self-reported breach costs nothing, a detected one costs a rung.
Insurance: Covered events, a deductible, per-claim and per-period ceilings, a period, and the evidence floor a claim must clear. Measurements round down and charges round up, so curation can never make cover look cheaper than it is. Solvency is enforced in storage, so a reserve cannot go negative.
Stake: Bonded collateral scaled by blast radius, with a multiplier for irreversible payments and slashing scaled by severity and repeat offence. The stake decision carries no allow field at all: it is structurally incapable of permitting anything.

Backstops

Where a claim about enforcement needs to be worth something to a party who does not trust us, assertion is not enough. So a challenge costs money to file and pays out if it succeeds: the challenger bonds a share of the value at stake, a successful refutation earns a share of that bond, the window is measured in days rather than minutes, and a meaningful number of independent watchers is required.

A refused filing always returns the stake, and the arithmetic is exact: what the challenger receives plus what remains of the bond equals the bond. A configuration that cannot be graded for griefing risk reports as unsafe rather than as fine.

Shaping spend

Periodic limits: Standing authority as a control parameter rather than a fixed number.
Concentration: A bound on how much of a mandate may go to any single counterparty.
Adaptive caps: Caps that respond to what has actually happened rather than sitting at whatever was set months ago.
Split: One payment in, several parties owed, as a governed object rather than as arithmetic in your code.
Metering: Governed metering and streaming, for things billed continuously rather than per purchase.
Credit: An underwriting decision for extending credit to an agent, which is a different question from whether to allow one payment.