The agent never holds write credentials. It proposes; COLVO decides against the mandate, holds for approval when needed, executes exactly once, and verifies the result against the provider.
Four stages, every one of them logged append-only. Nothing reaches Stripe until the policy says so.
e.g. “refund €500 on payment pi_01” — sent with the mandate id and the original request id. Idempotency-Key honoured.
Identity, scope, limits, currency, per-end-user caps, guardrails and provider state — all before anything is sent.
Allowed actions run idempotently through COLVO’s executor; risky ones wait for a human with an exact digest; violations are denied.
A read-only check confirms the provider state. Expected ≠ observed opens an incident — never a silent “completed”.
Refund €50 on the original payment method — executed once, then verified.
Unusual but plausible — paused with an exact digest for a reviewer to approve or reject.
Required data unavailable — no write happens until the state is readable again.
€500 exceeds the €50 limit — blocked before it ever reaches Stripe.
Your trusted backend registers a mandate: who the subject is, which actions are allowed, the limits, and when it expires. The agent can only propose inside it.
Stable business keys, budget reservations and a transactional outbox mean a retry, a crash or a double click never creates a second refund.
idempotentWhen Stripe answers late, refuses or times out, the operation reconciles from the provider’s own state instead of guessing.
reconciliationPause a project: no new writes, in-flight actions are held and re-queued on unpause. One click, logged.
pause / unpauseReviewers approve a digest of the exact action, not a summary. If the proposal changes, the approval is void.
signed digestMISMATCH and UNVERIFIABLE open incidents with the evidence attached; alerts go to Slack, email or a webhook.
alertingAppend-only: the proposal, the policy reasons, the approval, the execution attempts and the verification snapshot.
audit-readyGuard is part of the Guard plan or can be unlocked per organisation as an entitlement. See pricing →
Thirty minutes: we run your refund flow in the sandbox and show Guard deny the €500 refund a €50 mandate never allowed.