When software starts spending money, "the model decided to" is not an answer anyone can audit, and "we have a policy" is not one anyone can check. Unija turns every payment intent into a deterministic decision — allow, require a co-signature, escalate, or block — measured against a mandate that was committed in advance, and it leaves evidence anyone can re-verify offline. It does not judge whether spending is a good idea; it enforces, and evidences, a boundary you set earlier.
| case | amount (EUR) | counterparty | decision | bank rail |
|---|
Synthetic pilot data from the deployed deterministic kernel. Bank rail: Revolut Business sandbox — only an ALLOW ever touches it, and a replayed decision is refused by the rail itself.
Authority lives in an append-only registry: effective windows, suspension and revocation as new records — old authority never resurrects, and an AI can never issue or expand its own mandate.
Independent buckets per mandate, period and currency. A request over the remaining budget is refused by construction, not by convention.
Above the owner's thresholds a payment waits for a human co-signature with its own expiry. Waiting is a legitimate state, never an error.
The Wallet is the owner's side of the firewall: authority in your hand, never funds. Your money stays at your bank — the Wallet holds the mandates, the budgets and the pen.
The deciding kernel reads only explicit inputs — no network, no clock, no randomness. Same facts, same decision, every time.
Every decision ships as an evidence bundle a counterparty re-derives from bytes — without access to us, our servers, or our word.
Decisions are anchored on an independent evidence rail and confirmed by two independent witnesses. Payment data itself never leaves the owner.
Built on a crypto-agile, post-quantum-ready authorization architecture. Unija uses the NEOstack evidence rail as its backend.