> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Spend Guardrail
> The decision point for agentic payments: verify the passport, enforce the mandate, apply your policy, and get a signed ALLOW, DENY or REFER in one call.
## What it is
**Spend Guardrail** is the single check a platform makes *before letting an AI agent move money*. In
one call it verifies the agent's [Agent Passport](/agent-passport), enforces the payer's
[Payment Mandate](/payment-mandate) per-period cap, applies your platform policy — and returns a
**post-quantum-signed ALLOW or DENY decision** with the reasons.
It is the **authorization stack wired into a single enforcement gate**: *who the agent is* (Passport)
* *what the payer authorized* (Mandate) + *your rules* (policy), evaluated together, fail-closed.
Crucially, it **moves no funds**. It produces a decision; your execution layer does the on-chain pull
only when the decision is ALLOW. That keeps it a pure authorization-and-audit component — no custody,
no settlement, low regulatory surface.
Passport validity, scopes, and spend limit, your policy (allowlists, per-transaction caps, rolling
velocity windows), and the mandate's enforced per-period cap, all in one fail-closed evaluation that
refuses when it cannot confirm a credential is unrevoked.
Every ALLOW, DENY, and REFER is a post-quantum-signed receipt in a hash-linked chain: an offline
verifier checks the whole sequence and locates any altered or dropped decision. The chain folds
straight into the [Compliance Command Center](/compliance-command-center).
Beyond a binary verdict, a soft threshold or a flagged counterparty returns REFER (send to human or
step-up review) without drawing down the payer's mandate.
Each decision carries a freshness window so a stale receipt cannot be replayed, and the chain
persists (continuous across restarts) so velocity caps and the audit trail survive a restart.
The Guardrail decides; your platform executes on ALLOW. No custody, no settlement — easy to adopt
and easy to put through risk review.
Agent Passport + Payment Mandate, combined into the control plane an agentic-payments platform
actually integrates at the moment of spend.
## What you get
* **The missing control point.** Passport says *who*; Mandate says *what's authorized*. The Guardrail
is the single check that combines them — with your policy — at the moment an agent tries to pay.
* **Correct by construction.** Checks run in a deterministic, fail-closed order, and the mandate's
per-period cap is only consumed once everything else has passed — so a policy-denied attempt never
eats the payer's allowance.
* **A signed decision trail.** Every ALLOW and every DENY is a signed receipt, verifiable offline from
the public key. Hand a regulator or auditor a complete record of agent-spend decisions — not just
the payments that went through.
* **Policy you control.** Allowlists, per-transaction caps, required scopes, agent denylists, rolling
velocity windows (catching bursts that a calendar period cap misses), and a review threshold are
configured by you and evaluated alongside the credential and the mandate.
* **A review tier, not just a gate.** When a spend is too large to auto-approve but not clearly wrong,
the decision is REFER: route it to a human or a step-up check. A REFER never consumes the mandate.
* **Fails closed.** If a revocation directory cannot be reached, the gate denies rather than risk
honouring a revoked passport or mandate. The default posture for an enforcement decision is "refuse
when unsure".
* **Durable and replay-proof.** Decisions persist to your own store (a single file by default, or your
database), so the chain stays continuous and velocity holds across restarts; each decision carries a
freshness window so it cannot be replayed later.
* **Composes with the open tier.** Each decision is content-addressed with the same construction an
AP2/A2A adopter pins from the open Spend Guardrail reference, so a paid decision recomputes, byte for
byte, the reference they already trust. The commercial product adds the signing, the verifier, and the
enforcement they cannot get from the open tier.
* **Binds to settlement.** A decision can authorize a [Payment Gateway](/payment-rails-sqlite) payout: the
gateway signs the payout only against a fresh, valid ALLOW for that exact amount and destination, and
records which decision authorized it, so an auditor sees authorized then settled as one chain.
* **Optionally Substrate 2-bound.** Fold each decision receipt into the broader
[Substrate 2](/substrate-2) evidence chain.
## How it works
| Step | What happens |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Bound** | Reject oversized or malformed input deterministically, before any signature work. |
| **Verify** | Check the Agent Passport: signature, expiry, revocation, scopes, spend limit. Fail closed if revocation cannot be confirmed. |
| **Apply policy** | Allowlists, per-transaction caps, required scope, denied agents, rolling velocity window. |
| **Review** | If a soft threshold or flagged counterparty applies, return `REFER` without consuming the mandate. |
| **Enforce mandate** | Run the Payment Mandate's per-period authorize-charge (consumed only once everything above passes). |
| **Decide** | Return a signed `ALLOW` / `DENY` / `REFER` decision receipt (reasons, remaining headroom, freshness window) and append it to the chain. |
The platform executes the payment **only** if the decision is ALLOW.
## Cryptography
* **Post-quantum signing.** Every ALLOW, DENY, and REFER decision is a Falcon-1024-signed (NIST Level 5),
offline-verifiable receipt. The guardrail moves no funds and composes Agent Passport + Payment Mandate,
each itself post-quantum signed.
* **Hybrid, crypto-agile.** A decision can be co-signed with ML-DSA-65 (FIPS 204) alongside Falcon-1024,
so a future break of one scheme still leaves forgery requiring a break of the other, and a deployment
can rotate schemes without reissuing past receipts.
* **Tamper-evident chain.** Decisions are hash-linked; the bundled offline verifier checks every
signature and link and pinpoints the exact position of any altered or dropped decision, with no service
running.
## Why commercial
The decision engine was never published as open source — there is no free tier to fall back on. It is
offered as a **commercial product** because the value is in a maintained, correct, payments-grade
control point:
* **Embed without attribution overhead.** A commercial OEM licence lets you ship it inside your own
product with no open-source notice obligations.
* **Enterprise terms.** Support, warranty, and a defined relationship — for a payments-critical
decision dependency.
* **Maintained crypto suite.** Post-quantum primitives and the decision logic are ongoing work,
bundled into the licence.
## Who it's for
* **Agentic-commerce and autonomous-procurement platforms** that need one safe "can this agent pay
this, now?" gate before execution.
* **Agent frameworks and orchestrators** adding payments that need spend control and an audit trail
without building the cryptography and ordering themselves.
* **Wallets and PSPs** enabling agent spend that need enforced caps and a signed decision record.
* Anyone who needs a **single, auditable decision point** for agent spend that ties identity,
authorization, and caps together.
## Get Spend Guardrail
Spend Guardrail is an **additional, separately-licensed package** — an add-on that binds to Substrate 2,
not part of Substrate 2 itself. It is the capstone of the **authorization stack**
([Agent Passport](/agent-passport) + [Payment Mandate](/payment-mandate)) and is typically licensed
together with them. It is available **self-serve as a Starter licence (perpetual one-time or annual)** (see below) and as a **commercial OEM SDK** and is included in the AlgoVoi
Enterprise and [On-premise](/on-premise) plans. It is not distributed on public package registries.
Starter licence — **perpetual (one-time) or annual subscription**, self-hosted, paid in **USDC** on mainnet; the [store](https://api.algovoi.co.uk/suite-store) shows current pricing for both and issues your licence key + install command on settlement; install from the private index and set `ALGOVOI_LICENSE_KEY` to run. Enterprise / OEM (warranty, indemnity, SLA, multi-deployment, Substrate 2 binding): [email us](mailto:hello@algovoi.co.uk).