> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Spend Guardrail
> The decision point for agentic payments: verify the passport, enforce the mandate, apply your policy, and get a signed ALLOW, DENY or REFER in one call.
**Included in the [Payment Rails bundle](/payment-rails-sqlite).** One commercial licence installs this component together with the whole self-hosted payment-rails estate (alongside Agent Passport and Payment Mandate). It ships inside the bundle, not as a standalone product.
## What it is
**Spend Guardrail** is the single check a platform makes *before letting an AI agent move money*. In
one call it verifies the agent's [Agent Passport](/agent-passport), enforces the payer's
[Payment Mandate](/payment-mandate) per-period cap, applies your platform policy — and returns a
**post-quantum-signed ALLOW or DENY decision** with the reasons.
*Last updated: 21 August 2026.*
It is the **authorization stack wired into a single enforcement gate**: *who the agent is* (Passport)
* *what the payer authorized* (Mandate) + *your rules* (policy), evaluated together, fail-closed.
Crucially, it **moves no funds**. It produces a decision; your execution layer does the on-chain pull
only when the decision is ALLOW. That keeps it a pure authorization-and-audit component — no custody,
no settlement, low regulatory surface.
Passport validity, scopes, and spend limit, your policy (allowlists, per-transaction caps, rolling
velocity windows), and the mandate's enforced per-period cap, all in one fail-closed evaluation that
refuses when it cannot confirm a credential is unrevoked.
Every ALLOW, DENY, and REFER is a post-quantum-signed receipt in a hash-linked chain: an offline
verifier checks the whole sequence and locates any altered or dropped decision. The chain folds
straight into the [Compliance Command Center](/compliance-command-center).
Beyond a binary verdict, a soft threshold or a flagged counterparty returns REFER (send to human or
step-up review) without drawing down the payer's mandate.
Each decision carries a freshness window so a stale receipt cannot be replayed, and the chain
persists (continuous across restarts) so velocity caps and the audit trail survive a restart.
The Guardrail decides; your platform executes on ALLOW. No custody, no settlement — easy to adopt
and easy to put through risk review.
Agent Passport + Payment Mandate, combined into the control plane an agentic-payments platform
actually integrates at the moment of spend.
## What you get
* **The missing control point.** Passport says *who*; Mandate says *what's authorized*. The Guardrail
is the single check that combines them — with your policy — at the moment an agent tries to pay.
* **Correct by construction.** Checks run in a deterministic, fail-closed order, and the mandate's
per-period cap is only consumed once everything else has passed — so a policy-denied attempt never
eats the payer's allowance.
* **A signed decision trail.** Every ALLOW and every DENY is a signed receipt, verifiable offline from
the public key. Hand a regulator or auditor a complete record of agent-spend decisions — not just
the payments that went through.
* **Policy you control.** Allowlists, per-transaction caps, required scopes, agent denylists, rolling
velocity windows (catching bursts that a calendar period cap misses), and a review threshold are
configured by you and evaluated alongside the credential and the mandate.
* **A review tier, not just a gate.** When a spend is too large to auto-approve but not clearly wrong,
the decision is REFER: route it to a human or a step-up check. A REFER never consumes the mandate.
* **Fails closed.** If a revocation directory cannot be reached, the gate denies rather than risk
honouring a revoked passport or mandate. The default posture for an enforcement decision is "refuse
when unsure".
* **Durable and replay-proof.** Decisions persist to your own store (a single file by default, or your
database), so the chain stays continuous and velocity holds across restarts; each decision carries a
freshness window so it cannot be replayed later.
* **Composes with the open tier.** Each decision is content-addressed with the same construction an
AP2/A2A adopter pins from the open Spend Guardrail reference, so a paid decision recomputes, byte for
byte, the reference they already trust. The commercial product adds the signing, the verifier, and the
enforcement they cannot get from the open tier.
* **Binds to settlement.** A decision can authorize a [Payment Gateway](/payment-rails-sqlite) payout: the
gateway signs the payout only against a fresh, valid ALLOW for that exact amount and destination, and
records which decision authorized it, so an auditor sees authorized then settled as one chain.
* **Optionally Substrate 2-bound.** Fold each decision receipt into the broader
[Substrate 2](/substrate-2) evidence chain.
## How it works
| Step | What happens |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Bound** | Reject oversized or malformed input deterministically, before any signature work. |
| **Verify** | Check the Agent Passport: signature, expiry, revocation, scopes, spend limit. Fail closed if revocation cannot be confirmed. |
| **Apply policy** | Allowlists, per-transaction caps, required scope, denied agents, rolling velocity window. |
| **Review** | If a soft threshold or flagged counterparty applies, return `REFER` without consuming the mandate. |
| **Enforce mandate** | Run the Payment Mandate's per-period authorize-charge (consumed only once everything above passes). |
| **Decide** | Return a signed `ALLOW` / `DENY` / `REFER` decision receipt (reasons, remaining headroom, freshness window) and append it to the chain. |
The platform executes the payment **only** if the decision is ALLOW.
## Cryptography
* **Post-quantum signing.** Every ALLOW, DENY, and REFER decision is a Falcon-1024-signed (NIST Level 5),
offline-verifiable receipt. The guardrail moves no funds and composes Agent Passport + Payment Mandate,
each itself post-quantum signed.
* **Hybrid, crypto-agile.** A decision can be co-signed with ML-DSA-65 (FIPS 204) alongside Falcon-1024,
so a future break of one scheme still leaves forgery requiring a break of the other, and a deployment
can rotate schemes without reissuing past receipts.
* **Tamper-evident chain.** Decisions are hash-linked; the bundled offline verifier checks every
signature and link and pinpoints the exact position of any altered or dropped decision, with no service
running.
## Why commercial
The decision engine was never published as open source — there is no free tier to fall back on. It is
offered as a **commercial product** because the value is in a maintained, correct, payments-grade
control point:
* **Embed without attribution overhead.** A commercial OEM licence lets you ship it inside your own
product with no open-source notice obligations.
* **Enterprise terms.** Support, warranty, and a defined relationship — for a payments-critical
decision dependency.
* **Maintained crypto suite.** Post-quantum primitives and the decision logic are ongoing work,
bundled into the licence.
## Who it's for
* **Agentic-commerce and autonomous-procurement platforms** that need one safe "can this agent pay
this, now?" gate before execution.
* **Agent frameworks and orchestrators** adding payments that need spend control and an audit trail
without building the cryptography and ordering themselves.
* **Wallets and PSPs** enabling agent spend that need enforced caps and a signed decision record.
* Anyone who needs a **single, auditable decision point** for agent spend that ties identity,
authorization, and caps together.
## Frequently asked questions
### What is Spend Guardrail?
Spend Guardrail is the single check a platform makes before letting an AI agent move money. In one call it verifies the agent's Agent Passport, enforces the payer's Payment Mandate per-period cap, applies your platform policy, and returns a post-quantum-signed ALLOW, DENY, or REFER decision with the reasons. It moves no funds. Your execution layer does the on-chain pull only when the decision is ALLOW.
### What is the difference between DENY and REFER?
They are distinct outcomes. REFER is a review tier: when a spend is too large to auto-approve but not clearly wrong, or a counterparty is flagged, the decision routes to a human or a step-up check instead of a binary verdict. A REFER never consumes the payer's mandate, and the mandate's per-period cap is only drawn down once every other check has passed.
### What happens if a revocation directory cannot be reached?
The gate fails closed. It denies rather than risk honouring a revoked passport or mandate, because the default posture for an enforcement decision is to refuse when unsure. Each decision also carries a freshness window so a stale receipt cannot be replayed, and the decision chain persists across restarts so velocity caps and the audit trail survive a restart.
### Is every decision auditable?
Yes. Every ALLOW, DENY, and REFER is a Falcon-1024-signed receipt in a hash-linked chain, verifiable offline from the public key, and a bundled verifier checks the whole sequence and pinpoints any altered or dropped decision. The chain folds straight into the Compliance Command Center. Spend Guardrail ships inside the Payment Rails bundle as the capstone of the authorization stack, alongside Agent Passport and Payment Mandate.
## Get Spend Guardrail
Spend Guardrail ships inside the [Payment Rails bundle](/payment-rails-sqlite). One commercial licence
installs the whole self-hosted payment-rails estate. It is the capstone of the **authorization stack**
([Agent Passport](/agent-passport) + [Payment Mandate](/payment-mandate)), which ship in the same
bundle. It binds to Substrate 2 (it is not part of Substrate 2 itself), is included in the AlgoVoi
Enterprise and [On-premise](/on-premise) plans, and is not distributed on public package registries.
Install is token-gated from the AlgoVoi private index; set `ALGOVOI_LICENSE_KEY` to run. See the
[Payment Rails bundle](/payment-rails-sqlite) for licensing, or [email us](mailto:hello@algovoi.co.uk)
for Enterprise / OEM.