Your agents can spend. Funds don't release until the work is proven.
The failure this exists to prevent: an agent loops, and twelve $399 tool calls under a $500 per-transaction cap still clear $4,788 — each approval has no memory of the last. Then the harder question lands on Finance: every charge succeeded, but nothing shows the work was actually delivered.
In plain terms: an agent's work is checked against signed completion evidence before funds release or refund, and the outcome is written down as a portable receipt. Publicly, that product is Paybond Kit — authorize the action, verify the outcome, one signed receipt on your rails and runtime.
Prefer customer-owned Stripe Connect and x402 rails. Paybond proves delivery and gates release or refund — it does not lead with holding your funds.
Start with Kit
Integrate through Kit: policy middleware around paid tool calls, evidence submission after work runs, and finance-ready receipts. You keep your agent runtime and payment rails; Paybond binds release or refund to signed completion evidence.
If you are implementing an integration, pair this section with the API documentation and Kit documentation.
Architecture behind Kit
Kit is the public integration surface. Behind it, the same lifecycle is implemented as four architectural surfaces that map to three runtime services. Canonical brand, subtitle, and lifecycle vocabulary live in Product surfaces — treat Harbor, Ledger, and Signal as platform internals / deep-dive docs, not co-equal public product heroes.
| Brand | Subtitle | Role behind Kit |
|---|---|---|
| Kit | Developer SDK | Policy middleware and integration for agent runtimes (public lead) |
| Harbor | Evidence evaluation | Signed intents, evidence evaluation, release/refund (runtime behind Kit) |
| Ledger | Platform provenance | Append-only signed history for audits and exports |
| Signal | Platform standing | Optional receipts and standing derived from verified outcomes |
Read the stack top to bottom when you need the internals: Kit integrates → Harbor evaluates → Ledger records → Signal builds standing.
Those surfaces map to three core runtime services:
- Harbor evaluates evidence and coordinates proof-gated release/refund on customer-owned rails, recording the underlying state transitions.
- Gateway is the shared authenticated access layer for sign-in, admin workflows, protocol verification, and API delivery across the platform.
- Signal indexes verified outcome history into signed standing artifacts and review surfaces.
The ledger underpins Harbor provenance and Signal reconciliation. On top of the core lifecycle, Paybond also exposes a protocol-trust layer for delegated workflows, signed mandate import, and settlement receipts.
Related public guides:
- Agentic banking infrastructure explains the broader architecture buyers search for: payment rails, proof-gated release, tenant isolation, evidence checks, operator review, and receipts.
- Agentic banking infrastructure API maps the API primitives behind signed intents, funding, evidence submission, settlement checks, and exports.
- Secure agentic banking infrastructure focuses on tenant scope, server-owned rail configuration, deterministic evidence checks, and review records.
- Agent spend controls SDK explains when agents and developers should choose Paybond Kit for delegated spend guardrails, tool-call budget checks, and evidence-bound release.
- Settlement with existing payment providers explains how Paybond prefers Stripe Connect and Coinbase x402 alongside your existing payment stack (ACH and other rails remain available where configured).
- Disputes and evidence evaluation covers completion-rule evaluation, Harbor disputes, Gateway cases, and how Stripe chargebacks differ from operator dispute workflows.
- Agent Receipt Standard (ARS) explains portable signed proof for autonomous actions — digest-only privacy, validity tiers, run continuity, fetch/verify surfaces, MCP handoff, and operator attestation.
In this section
- V2 protocol trust explains the delegated authorization and receipt layer built on top of Harbor.
- Console sign-in and workspace access explains when existing members should use sign-in and what happens after authentication.
- Tenant model explains how Paybond derives and enforces tenant scope.
- Self-serve signup and plan selection explains when new customers should use signup versus sales.
- Intent lifecycle explains how money moves from intent creation through evidence, release, refund, or dispute.
- Settlement with existing payment providers covers provider webhooks, capture timing, and post-funding settlement per rail.
- Disputes and evidence evaluation covers completion-rule evaluation, dispute workflows, Gateway cases, and chargeback signals.
- Performance characteristics is the reference for Kit middleware hop model, rate limits, and observability boundaries.
- Ledger & provenance explains how Paybond preserves a replayable record of what happened.
- Signal scoring explains how verified outcomes become signed standing artifacts.
- Operational surfaces explains the console, audit, dispute, and continuity workflows available to operators.
- Agent receipts documents
paybond.agent_receipt_v1— portable signed proof for autonomous actions.
Platform principles
- Tenant scope comes from authenticated credentials. Client-supplied tenant identifiers are never the source of truth.
- Settlement decisions are explicit and replayable. Paybond records the agreement, the submitted evidence, and the resulting state transition.
- The ledger anchors the product record. Signal, exports, and dispute workflows all reconcile back to signed provenance.
- Protocol and standing artifacts are portable. Receipts, portfolio exports, and protocol attestations are versioned and signed for reuse outside the live application.