The whole stack exists to answer a single question — who said this payment could happen? — in a way that survives an audit. Here is the path every payment intent takes, and what each layer refuses to do.
Your agent asks to pay: whom, what, how much, under which mandate. The intent is a structured claim, not a chat message — and nothing about it is trusted yet. Raw payment data never leaves your side.
The deciding kernel is deterministic by construction: it reads only explicit inputs — no network, no clock, no randomness. Given the same intent and the same committed mandate it reaches the same decision every time, which is what makes the decision auditable at all. It authorizes nothing new: it cannot permit what the committed mandate did not already allow. It narrows; it never grants. And an AI can never issue or expand its own mandate — authority lives in an append-only registry with effective windows, suspension and revocation as new records, where old authority never resurrects.
Every request exits with one word — ALLOW, ALLOW WITH LIMITS, REQUIRE HUMAN APPROVAL, ESCALATE, or BLOCK — with reason codes that survive being read six months later by somebody else. Each decision carries its whole chain: the intent, the context it was committed against, the decision itself, the budget position, and a bundle bound by hash to all of it.
Only an ALLOW ever touches the bank. The payment instruction carries an idempotency key derived from the decision itself, so a replayed decision is refused by the rail — double-payment is impossible by construction, not by promise. This path is proven end-to-end on a live bank sandbox: allowed cases executed with real transaction identifiers, blocked cases never reached the rail, and a deliberate replay was refused by the bank's own systems.
The owner's side of the firewall. Approvals land here with their own expiry — co-sign with a touch, or let them lapse; waiting is a legitimate state, never an error. The Wallet holds authority, never funds: your money stays at your bank, and every action taken here becomes a receipt.
Every decision — allowed, held or blocked — is committed as 32 bytes to an independent evidence rail, confirmed by two independent witnesses, and shipped as a bundle any counterparty can re-derive from bytes: offline, alone, without access to us, our servers, or our word. Alter the evidence and verification fails, with named errors. Don't trust us — verify.
Unija runs on the NEOstack evidence rail and a crypto-agile, post-quantum-ready authorization architecture. The rail is not ours to bend: it is the same witnessed, hash-chained infrastructure that carries other regulated evidence — which is exactly why your auditor can trust a proof without trusting a vendor.