1 · The problem

You can delegate authority. You cannot delegate it narrowly.

A principal with companies in several countries signs a power of attorney, a bank mandate, a board resolution. Each one is a document describing what someone may do. The money then moves on a rail that has never read any of them. Between the grant and the payment there is nothing at all — and that gap is where every director who has ever robbed an absent owner has stood.

The grant is prose; the rail is a protocol

A mandate says "up to two hundred thousand, suppliers only, until December". The payment system knows an amount, an account number and a signature. Nothing carries the first into the second, so the limit holds only as long as the person holding it chooses to honour it.

Revocation is a letter, and a letter stops nothing

Withdrawing authority means writing to a bank, a registry and a counterparty, and then waiting. In the days between, the old authority still works — and in a dispute the question is never what you intended but what the record shows, on the day.

Afterwards you can prove what happened, never what was allowed

Statements show payments. Minutes show approvals, drafted afterwards by the person being asked about. The one thing nobody can produce is the boundary as it stood at the moment of the act — so the argument becomes whose account is more plausible.

2 · The solution

Write the boundary once, in a form nobody can edit, and put it in front of the money

Authority becomes data: what this delegate may do, up to how much per transaction, against which annual budget in which currency, to which classes of counterparty, between which dates, above which amount a second human must sign. Every proposed payment is checked against that grant before it reaches a rail, and the check leaves evidence that outlives everyone involved.

The grant becomes a record, not a documentEighteen fields, immutable once written. Changing it does not edit it — it writes a new, later version, and the newer one governs from its own date. Authority that has been revoked or has expired can only return through a new, positively dated grant, never by letting a revocation lapse.

The gate decides, and the delegate cannot brief itThe decision function reads six frozen inputs and returns one of five verdicts: allow, allow with limits, require a second signature, escalate, refuse. The delegate supplies the request and nothing else — not the mandate, not the policy, not the clock, not whether the recipient is a known one. There is no parameter through which to ask for more authority.

Above a line, a person signsThe threshold is part of the grant, not a setting someone can move. The approval is bound to that exact decision — not to the amount, not to the day — so an approval cannot be harvested and reused against a different payment.

Every decision becomes evidence, including every refusalEach one packs into a bundle a third party can verify years later, on a laptop, with no access to the principal, to us, or to any network. The verifier re-runs the same decision over the bundle's own inputs and either reproduces the verdict or names the reason it cannot.

In one sentence

A limitation on a delegate's powers is, in most of Europe, void against a third party who acted in good faith — the company is bound anyway. So the claim is not that the delegate cannot exceed his authority. It is narrower and it is the one that holds: the money does not move, and the breach is provable.

3 · The value

The same record, read by four people who do not trust each other

For the principalA boundary that holds while you are asleep in another time zone

The limit is enforced at the moment of the act, not discovered at the quarterly review. Withdrawal is immediate and total: the next request is refused because the grant that allowed it no longer governs, and nothing has to be written to anyone for that to be true.

For the office that runs itOne place where every delegation is written, and one answer to what it allows

Every company, every delegate, every ceiling, every co-signature line, in one form. What a delegate may do is a question with a single answer instead of a search through documents drafted by different lawyers in different years.

For the director acting in good faithProtection, not supervision

The honest delegate is the one with most to gain. Every act he takes carries a record that he was within his authority when he took it — so a later accusation is answered by evidence rather than by his word, and a payment he refused to make is also on the record.

For the auditor, the insurer and the courtThe boundary as it stood, reproducible without anyone's cooperation

Not a report about what the system did. The inputs, the rule that fired, the verdict, and a verifier that re-derives it independently. A copy with one value changed fails immediately and names what failed; the genuine one passes.

4 · By invitation — the gate is closed, the brief is not

Five verdicts, one bank, and a statement line that leads back to the mandate

The demonstration runs the real decision kernel against real grants and submits to a real bank API. You change one thing at a time — the amount, the recipient, the status of the grant — and watch the verdict change with it, each one carrying the rule that fired. Access is granted per person.

The ladder, in one minute

The same delegate, the same recipient, four amounts. Allowed. Allowed with the limits named. A second signature required, with the signatory named. Refused, with the ceiling that refused it. Then the recipient's status is changed and the same payment escalates instead — because a recipient nobody verified is not the same as a recipient who was checked.

A revoked grant, and what cannot bring it back

Withdraw the authority and the next request is refused on the spot. Then try the ways authority usually creeps back: let the revocation lapse, submit an older version, wait for the replacement to take effect. None of them work. Only a new, later, positively dated grant restores anything.

The bank's own record, carrying the decision

An authorized payment goes to the rail and comes back with the bank's transaction identifier. Ask the bank afterwards and its record carries the reference the gate wrote — the decision and the mandate it was authorized under. A line on a statement now leads back to the authority that permitted it. Submit the same authorization twice and the second one never reaches the bank: the key is derived from the decision itself, so a replay is refused and a re-authorization is visibly a different claim.

What is real

The decision kernel, the committed grants, the evidence bundles and the offline verifier are real and covered by 610 passing tests. The bank is a real bank API on its test rail — by design, so that a demonstration can submit a live payment and show you the bank's own record of it without a euro of real money existing anywhere in the path. The payment shown was submitted on 22 September 2026 and the reference it carries is the one the gate wrote.

REAL — Decision · Committed grants · Evidence · Offline verificationLIVE BANK RAIL — real API, test environment, no real money by designBY INVITATION — access granted per person610 TESTS

Open the demo →

1GUARD — authority written once in a form nobody can edit, enforced before the money moves, and provable afterwards without anyone's cooperation. The brief is open; the demonstration is by invitation.