Compliance runs before the operation, not after.
SecuritySupported provider operations pass through a compliance gate before execution. Credentials are encrypted, decisions are logged, and high-impact actions wait for approval.
Controls as code, not adjectives.
The control questionsEach answer traces to a path in the shipped runtime. Screening today resolves against builtin adapters, not a live provider API.
Did the gate run before execution?
The adapter runtime evaluates configured compliance policy before a supported provider operation continues. If the decision is not pass, the operation returns blocked.
Who had authority to approve?
High-impact actions route through deployment approvals with role-aware thresholds. Bearer keys are scoped to specific resources — a compliance key cannot move funds.
What evidence stays with the decision?
The record keeps the screening result, the approval state, and the providers in scope. Compliance, escrow, payment, and ledger audit tables are append-only — an UPDATE or DELETE raises an exception at the database.
An agent can explain the decision. It cannot override the gate.
The adapter runtime evaluates the compliance gate before supported provider operations continue. If the decision is not pass, the operation returns blocked, with the decision hashed into the audit record.
The same governance the UI relies on applies to every request.
How the gate runsThe path that screens an operation also records who authorized it, which decision the gate returned, and the evidence it produced — for operators in the UI and agents on the API alike.
Scope & encrypt
Credentials are stored per organization and encrypted with AES-256-GCM. Bearer keys are scoped to specific resources — a compliance key cannot move funds.
Gate & approve
The runtime evaluates the compliance gate before execution. Irreversible actions route through deployment approvals with weight-based, role-aware thresholds.
Hash & log
Decisions land in an append-only audit trail an examiner can follow from approval to execution, enforced by database triggers.
The engine is real. We mark the line rather than blur it.
What's real, what's simulatedThe compliance engine includes MiCA (EMT/ART), GENIUS Act traces, SAR generation, precedent query, reserve validators, and license tracking. The gate-before-execute path runs in dispatch. Screening today resolves against builtin adapters, not a live provider API.
Compliance engine
MiCA (EMT/ART), GENIUS Act framework traces, SAR generation, precedent query, reserve validators, and license tracking in the shipped code path.
Sanctions screening
Resolves through the mock-sanctions builtin adapter against a hardcoded watchlist and a jurisdiction check today. Live screening of real users is on the corridor-1 roadmap.
Chainalysis adapter
The one real provider integration packaged today. Every other provider in the directory is an eligibility example, not a connected integration.
Own & audit
You deploy contracts you own to Base / Base Sepolia, bring your own custody, and your audit trail lives in org-scoped tables under RLS.
Scoped keys, not master keys.
Security APIA key issued for compliance screening cannot move funds. The same governance an operator relies on in the UI applies to scoped agent requests.
# compliance-scoped key: allowed GET /api/v2/agent/compliance/precedent # compliance-scoped key: rejected POST /api/v1/agent-payments/execute # screening returns a decision { "decision": "BLOCK", "riskScore": 95 }
Read the provider matching spec.
WalkthroughThe category catalog, regime model, and the compliance gate in the dispatch path. Or contact us for an architecture walkthrough scoped to your controls and launch sequence.