What was approved is what executes
Approved payments are sealed to their amount and destination.
| Field | Approved | Instruction carries | Result |
|---|---|---|---|
| Source account | ac-jpm-usd-op | ac-jpm-usd-op | MATCH |
| Destination | Cobalt Logistics Group · ****f90f | Cobalt Logistics Group · ****f90f | MATCH |
| Amount | $100,000.00 | $100,000.00 | MATCH |
| Currency | USD | USD | MATCH |
| Legal entity | ACME-US | ACME-US | MATCH |
| Stated purpose | Settlement of INV-18377 | Settlement of INV-18377 | MATCH |
| Provider | pv-jpm | pv-jpm | MATCH |
| Authorization | APR-26002 | APR-26002 | MATCH |
| Validity window | ≤ 4h window | within window | MATCH |
| Replay check | nonce unused | nonce unused | MATCH |
It refuses, and it says which field disagreed.
The approval authorised one destination, one amount, one entity and one window. An instruction that differs on any of them is not a near-match to be waved through; it is a different instruction, and the binding is what notices.
The denial code is shown verbatim rather than translated into a sentence, because the code is what an operator filters on and what a conversation with the provider cites. A humanised explanation sits beside it, never instead of it.
- Entity
- Acme UAE
- Approved for
- $3,000
- Instruction carried
- $30,000
- Destination
- Falcon Technical Services LLC · United Arab Emirates
- Valid until
- 04 Oct 2026 · 14:20 UTC
- Nonce
- ad2dbd1ebb9b0cd984ee2ea8cd71917f
- Key
- kms://vadorail/ae/signing-04
- Algorithm
- Ed25519 · detached JWS
| Field | Approved | Carried | Result |
|---|---|---|---|
| Amount | $3,000.00 | $30,000.00 | MISMATCH |
| Source account | ac-enbd-aed-op | ac-enbd-aed-op | MATCH |
| Destination | Falcon Technical Services LLC · ****3228 | Falcon Technical Services LLC · ****3228 | MATCH |
| Currency | USD | USD | MATCH |
Protection after policy decides.
ShieldOS decides whether a payment may move. CryptoShield ensures the approved source, destination, amount, route and provider are the instruction that executes. Evidence records the result.
Signed transaction commitment
Source, destination, amount, route and provider are signed together, so a change to any of them invalidates the instruction.
Two-system authorization
Two independent systems must authorize an execution. Neither can release value alone.
Isolated execution boundary
Execution runs behind its own boundary with its own allowlist and hard limits.
Replay and duplicate protection
An instruction executes once. A repeat is refused, not re-sent.
Circuit breakers
Movement stops on the conditions you define, and restarting is a deliberate act.
Fail-closed by default
If a control cannot be evaluated, value does not move.
Post-quantum ready
The algorithm and key version are recorded on every signature, so what signed a payment is answerable later.
Bring your financial operations into one intelligent system.
Connect the ERPs, banks and providers you already run, establish one view of financial reality across them, and govern, reconcile and prove the work on top.
Onboarding is sales-led with company verification — there is no anonymous signup.