Product / Governance· target design · sandbox

Money needs a signature.

Spend warrants, dual control, separation of duties, revocation, and emergency stops — enforced independently of any agent.

01 / WARRANT

The authority object.

A canonical, versioned, Ed25519-verifiable warrant binds tenant, advertiser, campaign, channel, ceiling, expiry, policy revision, and approval lineage.

jsonspend warrant (excerpt)

{
  "warrant_id": "w_7f3a",
  "tenant_id": "tnt_acme",
  "campaign_id": "camp_88f1",
  "currency": "USD",
  "daily_ceiling_micros": 500000000,
  "total_ceiling_micros": 2000000000,
  "max_cpm_micros": 2400,
  "expires_at": "2026-11-10T00:00:00Z",
  "nonce": "9c2e…",
  "policy_revision": 14,
  "approvals": [{ "actor": "usr_cfo", "at": "…" }]
}

02 / CONTROL

Separation of duties.

The requester, approver, and executor are distinct principals when thresholds require it. No single identity is the universal approver.

Action	Default requirement
Create warrant	Operator, scoped to tenant
Approve above threshold	Second principal (dual control)
Execute spend	Valid warrant + reservation
Revoke warrant	Operator or security role; edge acknowledgment
Emergency stop	Documented role; no model required

03 / STOPS

Least destructive response first.

Global, tenant, advertiser, campaign, agent, connector, warrant, channel, and creative stops — each acknowledged and audited.

ADVISORYDRAFTAWAITING_APPROVALAPPROVEDDEPLOYINGLIVEPAUSEDFAILEDSETTLINGCLOSED

Test it in the sandbox.

Every surface is exercised against fixtures before a production credential is involved.

Start sandbox Documentation