Security Model

Authority is verified at action time.

LATCH fails closed across identity, confidential policy, and execution, keeping the autonomous model outside the trust boundary.

Fresh ENS Authorization

Role, status, wallet address, and capabilities are resolved from ENS records for every proposed action—never trusted from a stale database flag.

Organization onboarding and identity revocation require cryptographic signatures from the admin wallet controlling the ENS namespace.

Sensitive corporate rules are evaluated by Chainlink confidential computing workflows and are never stored in databases or sent to client browsers.

Product, vendor, quantity, and dollar amount are cryptographically bound to one authorization. Material modifications require a new verdict.

Each authorization token is single-use and consumed upon release, preventing duplicate executions or side-channel replays.

Local test providers are visibly labeled and fail closed if sponsor integration requirements are missing in hackathon mode.