Written once, enforced twice. A policy is a signed, versioned object in the terms of your own approval rules. Every decision names the exact version it was made under.
A sample policy, evaluated in your browser.
Decision
Step-up
approval_requiredAbove $150: a named person must sign
- Approval
- Asked of the approver
- Method
- Passkey, bound to the request hash
- Expires
- In 15 minutes
- Mandate
- Issued after the signature
In your own terms
Payees, caps, budgets, time windows, categories and approval thresholds, in the words of your approval matrix, signed as a version.
Atomic budgets
A budget is reserved when a decision is made and released or consumed when the rail posts. Ten concurrent agents cannot each pass the same $100 check.
Enforced twice
Enruta decides, then compiles the decision into the rail’s control: an exact-amount card, a purpose-scoped spend limit, or a one-bill approval.
Immutable versions
An edit creates version n+1. Every record names the version it was decided under, so an auditor reads version 7 in 2033 exactly as it was.
Fail closed
A request that matches no policy is denied with no_matching_policy. There is no default allow.
Duplicates and replays
Same payee, amount and reference inside the duplicate window is a deny. Same idempotency key returns the original decision, never a second mandate.