Situs is a trust layer for AI actions: any agent, any venue, any counterparty, the same proofs. An open receipt format, keys at well-known URLs, an offline verifier anyone can run, and a transparency log. Plugins add meaning; they never change what a proof means.
AI agents are starting to do things, not just say things: move money, issue refunds, change
systems. Situs sits between an AI and everything it can touch. Before anything happens, Situs checks it against
rules a person signed, asks a person when the rules say so, lets it happen exactly once, and leaves a receipt that
anyone can check.
Think of the controls a finance team already puts around people who move money: a written
mandate, a second signature for large amounts, each instruction carried out once, and a record an auditor can check. Situs gives an
AI the same controls, built into every action it takes.
pre-execution control. A deterministic authority turns a proposal into a single-use grant bound
to the hash of one exact action; one enforcement point holds the only credential; every party signs its own fact;
the Proof Receipt verifies offline.
An AI agent can read, reason and propose. It cannot act on its own: the password, API key or signing key sits with Situs, which uses it once, for one approved action, and never hands it over.
the agent holds only a gateway token; the credential is behind one enforcement point, which releases a 5-minute token per single-use grant (secret broker).
Rules a person signed decide. Not the AI.
A responsible person writes down what the AI may do, up to how much, and when to ask. Situs checks every request against those signed rules, the same way every time. The AI cannot talk its way past them.
an ed25519 or Touch ID signed Intent Contract under a versioned, signed profile; a deterministic engine with closed reason codes and no model call in the decision path.
A person approves what matters, exactly.
When the rules say so, a person is asked, by email, phone, app or a dialog on their computer. They approve the exact action they were shown, not a session or a button, and only for as long as the rules allow.
the approver signs the SHA-256 hash of the canonical action (RFC 8785 JCS); approval routes set channels and windows per approver type; a changed action has a different hash.
Once means once.
An approved action happens a single time. Retries, a second AI working the same request, or a restart cannot make it happen twice.
single-use grants with an idempotency key the counterparty enforces; the key is derived from the effect, and a second live grant for the same action is refused (duplicate_action).
Every decision leaves proof anyone can check.
Every yes and every no produces a receipt. An auditor, a regulator or a customer can check it on their own computer, without trusting Situs, and any change to it shows.
a Proof Receipt carries each responsible party's signature over its own fact (principal, approver, enforcement, counterparty); a transparency log; situs-verify runs nine checks offline.
The demo · plugin treasury
An AI treasury clerk, and the controls around it
A company's accounts-payable mailboxes receive vendor invoices. An AI agent reads them from one common queue and proposes payments. The treasurer has signed a mandate: which actions, how much per payment and per day, and when the approver must sign. One invoice is poisoned: it tells any AI reading it to pay a new bank account. The agent believes it. Situs refuses it, because the rules name the vendor's real account, and the refusal gets a receipt like everything else.
scripted agent by default, or Claude through the same gateway; every tool call is tied to the
message it came from (msg_ → ins_ → grant → receipt); the Dashboard shows every agent live.
The story, step by step
The mandateThe treasurer signs an Intent Contract: what the agent may do, up to how much, and when a person must approve.
A poisoned inboxInvoices arrive in the clients' mailboxes and reach the agent through one queue. One says to pay a new bank account. The agent believes it; policy refuses it.
A person approvesA legitimate $75,000 payment is over the threshold. The approver signs the exact action with Touch ID.
ExecutionThe enforcement point checks the grant, fetches a short-lived bank token the agent never sees, and pays once.
Retry stormThe agent re-sends the same grant three times. One transfer exists: single-use grants and idempotency.
RevocationThe treasurer revokes the mandate. The agent's next request is refused, and the receipt says so.
Offline proofAnyone verifies the receipt with nothing but the receipt. Change one digit and it fails, even if Situs re-signs it.
The gapThe same poisoned invoice sent straight to the bank with a raw API key is paid. No policy, no approval, no receipt (make demo-bypass).
The action a person approves in this storyline: NW-2026-0912, 75000.00 USD, for ven_northwind.
Green boxes are people. Each box is signed by the party in its lane; the
receipt binds them together, and Situs signs only the assembly.
Who does what
Treasurer (principal)
Decides what the agent may do. Signs the mandate, and can revoke it.
signs: contract_hash
Treasury agent (AI)
Reads invoices and proposes payments. Holds a gateway token only: no bank credential, no authority.
signs: nothing
Gateway
The only door the agent has. Records every model call and tool call as evidence.
records: request and response hashes
Authority Engine
Deterministic policy, no AI. Turns a proposal into a single-use grant, or a signed refusal.
signs: policy decisions, grants
Approver
A person. Signs the hash of one exact action, from the page, the email, or a Mac dialog.
signs: action_hash
Enforcement point (pep)
The only holder of the bank secret. Re-checks the grant and spends it once.
signs: enforcement decision
Bank (mock)
Moves the money once per idempotency key and signs what it did.
signs: bank acknowledgement
Situs assembly
Puts the parties' signed facts into one receipt and logs it. Cannot vouch for anyone else's fact.
signs: the assembly only
Who signs what
Treasurer (principal) signs: contract_hash
Treasury agent (AI) signs: nothing
Gateway records: request and response hashes
Authority Engine signs: policy decisions, grants
Approver signs: action_hash
Enforcement point (pep) signs: enforcement decision
Bank (mock) signs: bank acknowledgement
Situs assembly signs: the assembly only
Beyond the demo
Using Situs for something else
Nothing in the idea is about money. Wherever an AI can take an action that matters, the same five
controls apply: signed rules, a few named actions, a person for the ones that matter, once means once, and a
receipt. Only the rulebook and the connection to the system change.
In general
In this demo
Customer refunds
Cloud changes
Who sets the rules
the accountable owner
The treasurer
Head of customer support
Platform lead
The rulebook (profile)
what may be done, to whom, up to how much
treasury.v1: approved vendors and accounts, limits
refunds.v1: refundable order states, per-refund and daily caps
infra.v1: allowed services, change windows
What the AI may do (façades)
a few named verbs, nothing else
read a balance, fetch a rate, pay
look up an order, issue a refund
scale a service, roll back a release
Where the credential lives
an enforcement point
the bank credential, in the pep
the refunds API key
the cloud deploy role
When a person is asked
whatever the rulebook says
payments above $50,000
refunds above $500
any change to production
What the receipt proves
this action was allowed, approved if needed, and done once
a payment
a refund
a deployment
How to adapt it
Name the actions. List the few things the AI may do, as verbs with parameters, and nothing else.
façades in a new plugin, e.g. refunds.v1: orders.lookup, refunds.issue.
Write the rulebook. Who and what may be acted on, limits, when a person must approve, how long an
approval lasts. Publish it as a signed version.
the plugin's rule schemas and pure rules module; a profile per tenant (Policy tab).
Put the credential behind Situs. Only the enforcement point holds the key to the real system, and it
acts only on a valid, single-use grant.
a declarative connector.json for the target API, with the idempotency key passed through.
Point the AI at Situs and sign a mandate. The agent calls the gateway instead of the system; the
accountable person signs what it may do.
the gateway's tools or OpenAI-compatible endpoint; an Intent Contract per workload.
Give the receipts to whoever must trust them. Auditors, customers or regulators check them with the
verifier, on their own machine.
situs-verify, the transparency log head, and the published public keys.
This pilot ships one rulebook (treasury.v1) and one enforcement point, in front of a mock bank. Another use case is another plugin; the authority, approvals, receipts
and verifier stay as they are. Write a plugin, build against it,
or build an approver app.
What the build is against the design; guides for adopters, plugin authors and approver-app builders.
The live demo
It runs on its own machine
This page is the public front door. The demo, its keys, its evidence and every receipt live on one
confidential VM that starts on demand and stops itself. The tabs above open it when it is awake; when it is asleep
they say so. Receipts are checked with the VM's own published keys, never with anything served from here.