Spend Guardrail

​

What it is

Spend Guardrail is the single check a platform makes before letting an AI agent move money. In one call it verifies the agent’s Agent Passport, enforces the payer’s Payment Mandate per-period cap, applies your platform policy — and returns a post-quantum-signed ALLOW or DENY decision with the reasons. It is the authorization stack wired into a single enforcement gate: who the agent is (Passport)

• what the payer authorized (Mandate) + your rules (policy), evaluated together, fail-closed.

Crucially, it moves no funds. It produces a decision; your execution layer does the on-chain pull only when the decision is ALLOW. That keeps it a pure authorization-and-audit component — no custody, no settlement, low regulatory surface.

​

What you get

• The missing control point. Passport says who; Mandate says what’s authorized. The Guardrail is the single check that combines them — with your policy — at the moment an agent tries to pay.
• Correct by construction. Checks run in a deterministic, fail-closed order, and the mandate’s per-period cap is only consumed once everything else has passed — so a policy-denied attempt never eats the payer’s allowance.
• A signed decision trail. Every ALLOW and every DENY is a signed receipt, verifiable offline from the public key. Hand a regulator or auditor a complete record of agent-spend decisions — not just the payments that went through.
• Policy you control. Allowlists, per-transaction caps, required scopes, agent denylists, rolling velocity windows (catching bursts that a calendar period cap misses), and a review threshold are configured by you and evaluated alongside the credential and the mandate.
• A review tier, not just a gate. When a spend is too large to auto-approve but not clearly wrong, the decision is REFER: route it to a human or a step-up check. A REFER never consumes the mandate.
• Fails closed. If a revocation directory cannot be reached, the gate denies rather than risk honouring a revoked passport or mandate. The default posture for an enforcement decision is “refuse when unsure”.
• Durable and replay-proof. Decisions persist to your own store (a single file by default, or your database), so the chain stays continuous and velocity holds across restarts; each decision carries a freshness window so it cannot be replayed later.
• Composes with the open tier. Each decision is content-addressed with the same construction an AP2/A2A adopter pins from the open Spend Guardrail reference, so a paid decision recomputes, byte for byte, the reference they already trust. The commercial product adds the signing, the verifier, and the enforcement they cannot get from the open tier.
• Binds to settlement. A decision can authorize a Payment Gateway payout: the gateway signs the payout only against a fresh, valid ALLOW for that exact amount and destination, and records which decision authorized it, so an auditor sees authorized then settled as one chain.
• Optionally Substrate 2-bound. Fold each decision receipt into the broader Substrate 2 evidence chain.

​

How it works

The platform executes the payment only if the decision is ALLOW.

​

Cryptography

• Post-quantum signing. Every ALLOW, DENY, and REFER decision is a Falcon-1024-signed (NIST Level 5), offline-verifiable receipt. The guardrail moves no funds and composes Agent Passport + Payment Mandate, each itself post-quantum signed.
• Hybrid, crypto-agile. A decision can be co-signed with ML-DSA-65 (FIPS 204) alongside Falcon-1024, so a future break of one scheme still leaves forgery requiring a break of the other, and a deployment can rotate schemes without reissuing past receipts.
• Tamper-evident chain. Decisions are hash-linked; the bundled offline verifier checks every signature and link and pinpoints the exact position of any altered or dropped decision, with no service running.

​

Why commercial

The decision engine was never published as open source — there is no free tier to fall back on. It is offered as a commercial product because the value is in a maintained, correct, payments-grade control point:

• Embed without attribution overhead. A commercial OEM licence lets you ship it inside your own product with no open-source notice obligations.
• Enterprise terms. Support, warranty, and a defined relationship — for a payments-critical decision dependency.
• Maintained crypto suite. Post-quantum primitives and the decision logic are ongoing work, bundled into the licence.

​

Who it’s for

• Agentic-commerce and autonomous-procurement platforms that need one safe “can this agent pay this, now?” gate before execution.
• Agent frameworks and orchestrators adding payments that need spend control and an audit trail without building the cryptography and ordering themselves.
• Wallets and PSPs enabling agent spend that need enforced caps and a signed decision record.
• Anyone who needs a single, auditable decision point for agent spend that ties identity, authorization, and caps together.

​

Get Spend Guardrail

Spend Guardrail is an additional, separately-licensed package — an add-on that binds to Substrate 2, not part of Substrate 2 itself. It is the capstone of the authorization stack (Agent Passport + Payment Mandate) and is typically licensed together with them. It is available self-serve as a Starter licence (perpetual one-time or annual) (see below) and as a commercial OEM SDK and is included in the AlgoVoi Enterprise and On-premise plans. It is not distributed on public package registries.