Five checks.
One safe payment.
Before any agent moves a dollar, Oris signs five answers. Who paid. What for. Under what rule. Was the world clean. Who is liable.
ENS-pattern resolver federation, authoritative on Base mainnet.
OFAC · UN · EU · Chainalysis · TRM · internal AML stream.
Sealed envelope unsealable only by regulator + Oris MPC quorum.
Merkle root committed on Base mainnet, mirrored cross-chain.
Who paid.
Every agent traces back to a real entity. A person, a treasury, a company, or a fund. The identity is signed and bound to the legal owner.
"At 03:14 UTC, who legally owned the spend that the agent placed on this card?"
Bundle field
- agent_diddid:ethr:8453:0x…
- tenant_nodebytes32 namehash
- kya_levelu8 · public verdict
- kya_statusbytes32
Maps to
FinCEN CIPcustomer identification
EU AMLR Art. 19beneficial owner
MAS FSM-N02customer due diligence
OCC 14-30agency relationship
What was bought.
Counterparty, amount, asset, chain, and category, locked into one signature. No swap. No rewrite. No replay.
"Show me the exact good, the exact counterparty, and the exact amount, provably the same as what the agent intended to buy."
tx_intent fields
- counterpartyaddress
- amount_usd_e6u64
- stablecoinbytes4
- chain_idu64
- categorybytes32
- nonceRedis SETNX 30s
- expires_atu64
Replay protection
- Recursive sig binds nonce + expires_at + tx_intent
- 30-second Redis SETNX window per nonce
- No bundle re-usable at any verifier on any chain
- Bundle hash domain-separated: keccak (EVM) + Poseidon (ZK)
Under what rule.
Caps, allowlists, blocked categories, approval thresholds. Your policy lives on chain, signed by your issuer. The matching rule rides inside every payment.
"Which firm-internal rule was the agent operating under when it made this purchase, and when was it last updated?"
Policy DSL · sample
- daily_cap_usdu64
- per_tx_cap_usdu64
- allowed_categoriesbytes32[]
- counterparty_allowlistaddress[]
- approval_threshold_usdu64
- velocity_window_su32
On-chain
- OrisPolicyRegistryversioned
- Per-tenant Merkle rootbundle-embedded
- Policy version signingMPC issuer
- Tenant rotationsupported
- Off-chain eval<10ms · Rust HFT
Was the world clean.
Sanctions verdict, risk tier, drift score, AML flags. Checked in milliseconds. Signed by a registered ring. Stamped onto every bundle.
"At the moment of payment, was the counterparty sanctions-clean and the agent's risk tier within tolerance, and who signed that determination?"
VerisAttestation
- sanctions_cleanbool
- risk_tierlow|med|high|blocked
- drift_score_bpu16 · 0..10000
- aml_flagstag[]
- signer_pubkeyBLS12-377 G1
- signatureBLS aggregate
- expires_at5–15min TTL
Feed sources · provenance preserved
- OFAC SDN15-min poll
- UN Consolidated15-min poll
- EU FSF15-min poll
- Chainalysiswebhook + REST
- TRM Labsstreaming gRPC
- Internal AMLkafka stream
Who is liable.
A sealed disclosure names every responsible party. Only the regulator and Oris together can open it. Inside, the full chain of approvals, sealed and replayable.
"This transaction was fraudulent. Show me the chain of legal responsibility, and prove it cannot have been edited after the fact."
Sealed envelope
- Encryptionthreshold
- Key holdersregulator + Oris MPC
- Auto SAR draftFinCEN-shape
- Real-time alertwebhook + stream
- Audit-traceroot to leaf
Data availability
- Celestiawarm
- Arweavecold
- IPFS-Filecoinredundant
- Anchor commitBase mainnet
- Retentionprotocol-durable
Five jurisdictions.
One portal.
Every authority gets its own key and its own view. SAR drafts in the right filing shape. Real-time alerts over webhook or websocket.
SAR auto-draft in FinCEN BSA E-Filing shape. CTR if threshold crossed. Real-time stream for sanctions hits.
Agency-relationship reporting for chartered partners. Agent operator and chartered bank mapped via bundle metadata.
Securities-touching agent flows annotated. Bundle replay supports Rule 17a-4 retention and 15c3-5 risk controls.
FSM-N02 CDD alignment. PSN02 stablecoin-rail oversight. Bundle hash anchored for audit inspection under the FSMA.
AMLR Art. 19 beneficial-owner mapping. AMLA central registry integration shape under design with the L7 disclosure module.
Anchored.
Timed. Replayable.
Every bundle anchored on Base. Every revocation timed to the second. The auditor sees exactly what the rail saw.
Below, a redacted replay of one tenant's last six minutes. Every line matches the verifier record. The regulator stream serves the same data in real time.
See only the payments
that matter.
Subscribe to revocations, sealed envelopes, and anchor commits in real time. Filter by jurisdiction. Open the envelope only when you need to.