One obligation.
One enforced limit.
The exact payment. Shared authority. A fresh decision before every governed release.
Company authority persists across Agent handoffs, retries and governed payment paths. The installed boundary checks the exact original before release.
Workspace SandboxStart free with one workflow and its authority evidence. SDK fixtures and installed checks retain separate scopes. Production enforcement requires qualification and operational approval.
CHANGE THE AGENT. KEEP THE ORIGINAL.
Already submitted
UNKNOWNIt may have paid. It may still pay.
New request
Same obligation.
Different payment path.
Shared authority
- Reserved
- $10,000
- Available
- $0
No second release.
Not dispatched
The fallback remains before the execution boundary.
Synthetic full-payment example. Amounts describe payment authority, not an account balance.
Every governed path must enforce the same current authority. A path outside that control can still execute independently.
02 / Evidence changes eligibility
Three outcomes.
Three decisions.
Alternative evidence states for the original payment. A timeout alone does not establish failure.
It may still pay.
Keep capacity reserved.
The obligation is satisfied.
Completed payment consumes the authorized capacity.
It did not pay.
It cannot pay later.
Recheck the exact payment, current authority and governed path. ACCEPT only if valid.
Evidence can restore eligibility. It does not authorize release.
03 / The release contract
Authority has conditions.
A different path must preserve the same limit. Every governed release needs a current decision.
The exact payment.
Bind the recipient, amount, currency and purpose to the buyer-defined obligation. A changed payment needs its own decision.
Current authority.
Check authority immediately before release. An earlier ACCEPT cannot be reused for a later request.
One shared limit.
Completed effects and unresolved attempts count against the same authorized capacity. A new route, request ID or credential cannot create another right to pay.
Deterministic checks. No generative model decides ACCEPT, HOLD or REFUSE.
How to read the evidence
Qualify the outcome evidence.
- MATCH
- Bind bank or provider records to the original attempt, recipient and amount.
- VERIFY
- Check source, freshness and conflicts. Interpret the status under that payment rail’s rules. Timeout alone is not proof of failure.
- RESOLVE
- A confirmed payment consumes capacity. Restore eligibility only after authoritative no-effect closure excludes later execution.
Reliable outcome evidence must identify the original payment, resolve conflicting records and establish whether it can still take effect. Eligibility means the payment may be reconsidered; a fresh release decision remains necessary.
04 / Decision and authority
Evaluate. Shadow. Enforce.
Each stage has an explicit authority boundary.
A paid workflow assessment is optional. It reviews agreed records; technical testing has a separate scope and accepted non-production setup.
05 / Coverage is a condition
The boundary
must be complete.
The shared limit must hold wherever the same obligation can be paid.
Map the same obligation.
Establish which requests can pay it across providers, workers and manual routes.
Verify the enforced boundary.
Confirm that every in-scope path follows the shared limit, including concurrent requests and recovery.
Qualify outcome evidence.
Establish what proves payment, safe closure and exclusion of later execution.
Current supported profiles: controlled BILL original-owner, Agent handoff and installed execution checks have their own scoped evidence. The separate Increase Sandbox reference covers fictional own-account USD 10 on one host. Neither establishes customer acceptance or native qualification of the other. Current installed evidence and limits.
Historical supplier-model baseline: the synthetic full-payment USD illustration on this page retains actual buyer paths / native provider calls of 0 / 0. This count describes that baseline only.
Separate engineering reference: RC15 R1 checks an own-account USD cash-movement candidate with local processes and provider-contract fixtures. It does not natively validate the fictional supplier-payment model here. RC15 R1 results and limits.
Already-submitted external payments need separately qualified intake and outcome evidence. Partial payments, FX, refunds and production disaster recovery need separate evaluation. Real-money production is not approved.