From one agent payment to evidence your bank can check itself.
HalvorAI records every payment an AI agent makes, on any rail, checks the proof that it was allowed, watches for behaviour that doesn't fit, screens who got paid, and packages it all as signed evidence. This page walks through each step.
Four ideas hold the whole system together.
Everything else on this page follows from these.
One format for every rail
Stripe, x402, MPP and card payments are all turned into the same shape: the open Agent Payment Event (APE). Everything after that only has to understand one format.
Recorded at the source
A free SDK inside your app builds each event and signs it with your own key. HalvorAI never sits inside the payment, so it can't slow one down or stop one.
Checked alongside, not in the way
Events are accepted in a fraction of a second. Proof checks, sanctions screening and behaviour analysis run right after, in the background.
Nothing is ever edited
Events and results are append-only and chained by fingerprints. Evidence packs are signed and stored write-once, so anyone can prove nothing changed.
From an agent paying one cent to a bank reading the evidence.
A travel-booking agent pays an API $0.01 over x402. Here is everything that happens to that payment, in order.
- 1
Record and sign
The SDK sees the payment and builds an event: which agent paid, who it acted for, on what instruction, to whom, how much, plus any network proof. Card numbers are stripped, the instruction text is hashed, and the event is signed with your key.
agent agt_07 · travel booking owner own_4410 rail x402 · $0.01 signed · Ed25519
- 2
Send in batches
Events queue up and go to HalvorAI in small batches over HTTPS, with retries if the network drops. The payment itself has already gone through.
POST /v1/events 202 accepted · 1 event
- 3
Check and seal
We check the event's shape and signature, drop duplicates, and give it its place in your organization's chain of fingerprints. From here it can't be changed.
signature valid chain #18233 · c0e8…
- 4
Screen the payee
The payee's name and wallet are checked against the OFAC, UK, EU and UN sanctions lists first, so a sanctions alert is never late.
screening clear · 5 lists
- 5
Verify the proofs
Any proof attached to the payment (an AP2 or Mastercard mandate, a Visa TAP signature, an x402 payload) is checked, then we confirm the payment stayed inside the mandate's limits.
x402 payload valid mandate within limits
- 6
Compare with normal behaviour
The payment is compared with how this agent usually behaves. Forty identical payments in six minutes trips the loop detector and raises an alert with a plain-English reason.
repeats 40 in 6 min · same payee alert · runaway loop
- 7
Review the alert
Your risk lead reads the reason, then dismisses it with a note or escalates it into a case. Dismiss reasons are tracked, so noisy checks are easy to spot and tune.
alert → case cs_2Q7 note "retry bug, fixed in 1.4.2"
- 8
Build the evidence pack
The case's events, proofs, results and notes are gathered into a signed pack: a PDF summary, the raw data, and an import file for your bank's case tools.
pack pck_01JA8T2 signed · stored write-once
- 9
Share it with your bank
You send a private, expiring link. The bank opens it without an account, downloads the pack, and can verify offline that nothing was altered.
$ npx @halvorai/ingest verify-pack PASS · 14 files · chain intact
Three kinds of check on every payment.
Each result is written down with the reason for it, so anyone reviewing a case can see what was known and when.
Was it allowed?
We read the credentials the networks already issue. You never re-type spending limits into HalvorAI.
- Google AP2mandate
- MastercardVerifiable Intent
- Visa TAPagent signature
- x402payment payload
Is it normal for this agent?
We learn each agent's usual pattern (how often, how much, which payees, which rails) and flag what doesn't fit. The rules are explainable, with no black-box model, which makes bank model reviews simpler.
- Runaway loopsvelocity spikes
- Unusual amountsnew payees
- Scope driftmandate breaches
- Invalid proofsmissing attribution
Who got paid?
Every payee's name and crypto wallet is screened against public government lists, refreshed several times a day. Fuzzy matching handles spelling and transliteration, and every hit shows the list, the entry and the score.
- OFACSDN + consolidated
- UKsanctions list
- EUconsolidated list
- UNSecurity Council
Change one cent and the evidence says so.
Each event's fingerprint includes the one before it, and a signed seal covers the chain each day. Edit or delete any event and every link after it stops matching. Try it.
verify-pack is open source and ships with the SDK, so a bank can check a pack without trusting HalvorAI or calling our servers.
What's inside the pack your bank receives.
One signed zip per case, or a whole-programme due-diligence report. It supports your bank's own review and any report it decides to file. Only your bank files reports; we never do.
- summary.pdf
- A readable account of the incident: agents, owners, instructions, timeline and outcome.
- events
- Every payment event exactly as your SDK signed it.
- proofs
- Each network credential attached to those payments, and whether it verified.
- results
- Screening hits, behaviour findings and the reason behind each one.
- chain positions
- Where each event sits in the chain, and the signed daily seals that cover them.
- timeline.csv
- One row per event, ready to import into your bank's case tools.
- case notes
- Your team's decisions, who made them and when.
- manifest
- A signed list of every file's fingerprint. Change any file and verification fails.
Four kinds of key, each with one job.
The key that proves an event is genuine never leaves your systems. The key that signs packs has a public half anyone can check against.
| Key | Who holds it | What it proves |
|---|---|---|
| Source key | Your servers only. Created with npx @halvorai/ingest init. | This event was written by your SDK install and not changed since. We only ever see the public half. |
| API key | Your servers. | This request comes from your organization. We store it only as a fingerprint and show it to you once. |
| Pack signing key | HalvorAI. | HalvorAI built this pack and this daily seal. The public half is published so banks can check offline. |
| Share link | Whoever you send it to. | Permission to view one pack, read-only. It expires, can be revoked, and every view is logged. |
Built into the product, not left to policy.
Never in your payment path
We watch and record. Nothing we run can approve, delay or block a payment.
Limits come from the networks
Spending limits are read from AP2, Verifiable Intent and TAP credentials. We never ask you to type them in.
Evidence, not reports
We produce evidence packs and case files. Only your bank decides whether to file a suspicious activity report.
Append-only evidence
Events, results and pack manifests are never updated or deleted. Corrections are new records that point at the old one.
Sensitive data stays with you
The SDK strips card numbers and secrets and hashes instruction text before anything leaves your systems.
Your data is walled off
The database itself filters every query to your organization, and test and live data never mix.
The format and the SDKs are open.
Apache-2.0, on GitHub. You can read exactly what gets recorded and how it's signed before you install anything.
Words on this page.
- Rail
- A way money moves: cards, Stripe, x402 stablecoin payments, MPP, bank transfers.
- APE
- Agent Payment Event: our open, rail-neutral format for one agent payment.
- Mandate
- The owner's signed permission for an agent: how much, to whom, until when. Issued by the networks, not by us.
- AP2
- Google's Agent Payments Protocol. Its mandates are signed credentials we verify.
- Verifiable Intent
- Mastercard's chain of signed credentials linking a person's intent to an agent's checkout.
- TAP
- Visa's Trusted Agent Protocol: an agent signs its requests so merchants know which agent it is.
- x402
- A protocol that uses HTTP status 402 to let agents pay for API calls, usually in USDC.
- MPP · MCP
- Stripe's Machine Payments Protocol, and Model Context Protocol tools that let an AI model take a payment action.
- Fingerprint
- A short hash (SHA-256) of some data. Change one character and the fingerprint changes completely.
- Baseline
- An agent's normal behaviour over recent weeks, used to spot what doesn't fit.
- KYA
- Know Your Agent: which agent is acting, and for whom. We accept KYA data; we don't issue it.
- Sponsor bank
- The licensed bank behind a fintech's cards or accounts, and usually the party that asks for evidence.
See it on your own agent traffic.
The SDKs are on npm and PyPI today. Sandbox keys and the dashboard are issued by invite to early-access teams.