Skip to main content
Agentic commerce needs a durable record that a sanctions, PEP, or AML screen ran, without writing personal data into the record itself. AlgoVoi’s no-PII compliance receipt does exactly that: the screening verdict is bound to a payer_ref, the SHA-256 of the payer’s network and address, so the canonical bytes carry no wallet address and no personal data, while a verifier who already holds the original network and address can still reconstruct the reference and confirm the match.

​
The no-PII construction

payer_ref is a content-addressed reference to the payer identity, not the raw address. The cleartext address is screened by your provider but never emitted; only its digest appears in the receipt: 
import hashlib
payer_ref = "sha256:" + hashlib.sha256(f"{network}:{address}".encode()).hexdigest()
The receipt therefore does not expose the payer’s wallet at the canonical-bytes level. A verifier with access to the original network and address recomputes the hash independently and confirms it; a verifier without that access learns nothing about who the payer is. This is the inverse of a vendor reputation score: the evidence is content-addressed and client-sovereign, verifiable by anyone, owned by no registry.

​
A categorical verdict, byte-distinct

The screening outcome is a closed enumeration. Each value produces a different content_hash under JCS, so the verdict cannot be silently altered:
ValueMeaningRegulatory significance
ALLOWPayer passed all screening checks.Baseline positive record, no SAR obligation triggered.
REFERPayer matched a watchlist or risk threshold; manual review required.Triggers SAR obligation under POCA 2002 s.330 (UK) / AMLR Article 56 (EU).
DENYPayer matched a sanctions list or failed a mandatory check.Triggers tipping-off rules under SAMLA 2018 s.20; the reason must not be disclosed to the payer.
A probability score, risk tier, or intermediate state is not an acceptable substitute in the canonical record. The categorical outcome is what regulators can reconstruct at audit time; the screening detail stays in the operator’s internal records, not in the receipt.

​
Bind the verdict to the policy in force

A verdict on its own does not record which policy produced it. Compliance Gate (lite) closes that gap with a gate_ref that binds the verdict and the no-PII payer reference to the pinned policy snapshot: 
payer_ref = "sha256:" + SHA-256(JCS({ address, network }))
gate_ref  = "sha256:" + SHA-256(JCS({ payer_ref, subject_ref, verdict }))
Because the verdict is bound to the policy by hash, a decision made under one policy snapshot does not recompute under a rotated policy. Rotation is detectable, not silent. It is Apache-2.0 and additive over the open substrate, using the same RFC 8785 JCS and SHA-256 primitives with no new cryptographic dependency. 
from algovoi_compliance_gate_lite import payer_ref, gate_ref, verify

payer = payer_ref("base", "0x...payer")           # no PII: only the sha256 is emitted
ref = gate_ref("ALLOW", payer, "sha256:aaee2091...")
verify(ref, "ALLOW", payer, "sha256:aaee2091...")  # True
verify(ref, "DENY",  payer, "sha256:aaee2091...")  # False, verdict tamper detected

​
Verify with no issuer call

A verifier holding the receipt recomputes the hash offline and confirms the verdict was made for exactly this payer under exactly this policy. No issuer call, no registry lookup, no AlgoVoi service. The compliance_gate_lite_v1 and compliance_receipt_v1 vector sets are published in the public conformance corpus with Python and Node runners that reproduce every value byte-for-byte.

​
Specification and authorship

AlgoVoi-authored, specified in IETF Internet-Drafts draft-hopley-x402-compliance-receipt and draft-hopley-x402-retention-chain (§7.8 Compliance Gate Binding), both normatively referencing the canonicalisation substrate. Open packages: algovoi-compliance-gate-lite, Python and TypeScript byte-for-byte identical.

​
See also