When software starts spending money, "the model decided to" is not an answer anyone can audit, and "we have a policy" is not one anyone can check. Unija turns every payment intent into a deterministic decision — allow, require a co-signature, escalate, or block — measured against a mandate that was committed in advance, and it leaves evidence anyone can re-verify offline. It does not judge whether spending is a good idea; it enforces, and evidences, a boundary you set earlier.
| case | amount (EUR) | counterparty | decision | bank rail |
|---|
Synthetic pilot data from the deployed deterministic kernel. Bank rail: Revolut Business sandbox — only an ALLOW ever touches it, and a replayed decision is refused by the rail itself.
Authority lives in an append-only registry: effective windows, suspension and revocation as new records — old authority never resurrects, and an AI can never issue or expand its own mandate.
Independent buckets per mandate, period and currency. A request over the remaining budget is refused by construction, not by convention.
Above the owner's thresholds a payment waits for a human co-signature with its own expiry. Waiting is a legitimate state, never an error.
The Wallet is the owner's side of the firewall: authority in your hand, never funds. Your money stays at your bank — the Wallet holds the mandates, the budgets and the pen.
The deciding kernel reads only explicit inputs — no network, no clock, no randomness. Same facts, same decision, every time.
Every decision ships as an evidence bundle a counterparty re-derives from bytes — without access to us, our servers, or our word.
Decisions are anchored on an independent evidence rail and confirmed by two independent witnesses. Payment data itself never leaves the owner.
Built on a crypto-agile, post-quantum-ready authorization architecture. Unija uses the NEOstack evidence rail as its backend.
One delegated payment ran end to end and its evidence lives at position 90 006 276 of the evidence rail — batch root d80d94fb…, two independent witnesses, re-verified offline against a pinned witness registry. Thirty-two bytes crossed the wire; the payment data never left the owner.
A within-mandate payment reached the bank sandbox (tx 055746a9…); the same decision replayed was refused by the rail itself; an over-mandate attempt produced zero rail calls — the firewall is a property of the construction, shown by execution.
A payment above the co-sign threshold waited for strong customer authentication — two factors, the exact transaction hash-bound to what the owner saw — then settled (tx 055746aa…). An HTTP 402 paid by mandate, not by card, settled the same way (tx 055746b0…).
Bank legs run on a live bank sandbox; amounts are pilot-scale by design. Standards composed: EU TS12 payment-SCA · AP2 mandate chains · x402 · SD-JWT.