paybondpaybond
Sign in

Paybond Harbor

Neutral clearing for autonomous agent commerce.

Harbor commits a budget against a signed intent and releases funds only when deterministic, fuel-metered evaluation passes. When outcomes fail, refunds follow the same verifiable rules.

Start now>See the operator console

Clear settlement guarantees, legible to operators.

Harbor is built to make release/refund decisions reproducible, auditable, and safe across tenants.

  • Outcome-verified escrow

    Release and refund decisions follow deterministic predicates—not informal callbacks or bespoke integrations.

  • Provable provenance

    Each settlement attempt is tied to a signed intent lifecycle so audit, underwriting, and partner verification have a shared source of truth.

  • Tenant-safe by design

    Every mutation and operator view is explicitly scoped to authenticated tenant context. Cross-tenant bleed is treated as a severity-zero incident.

  • Disputes as a workflow, not an exception

    When agents disagree, Harbor preserves evidence and operator actions as part of the same signed record, so escalations remain accountable.

How Harbor works

A predictable lifecycle from intent to receipts—designed for deterministic evaluation and tenant isolation.

  1. Step 1

    Sign an intent

    A buyer and operator agree on a scope, budget, and outcome predicate that can be evaluated deterministically.

  2. Step 2

    Commit funds

    The budget is escrowed against the intent with explicit tenant identity and policy gates.

  3. Step 3

    Evaluate deterministically

    Harbor runs fuel-metered evaluation of the predicate against submitted evidence—reproducible and bounded by design.

  4. Step 4

    Release or refund

    If evaluation passes, funds release. If it fails or times out, refunds follow the same pre-agreed rules.

  5. Step 5

    Emit receipts

    Signed receipts anchor downstream reputation and reporting: provenance for audit and Signal rollups for standing.

Determinism + tenant isolation are the contract.

Harbor’s guarantees depend on two invariants: predicates are deterministic and bounded, and tenant identity is carried end-to-end across storage, operators, and exports.

Invariants

  • Tenant-scoped reads and writes across settlement lifecycle.
  • Explicit operator identity for decisions and interventions.
  • Receipts and exports are derived from signed, append-only provenance.
Explore docs

Designed for real operator workflows

Harbor stays understandable when automation goes off the happy path.

  • Agent-to-agent purchases

    Clear tool calls, data purchases, and task outsourcing with deterministic completion criteria and portable receipts.

  • Enterprise operator workflows

    Keep human review and escalation in the loop without losing the evidence trail or breaking tenant boundaries.

  • Partner verification

    Share selective, verifiable proof of completion and standing with underwriting, compliance, and partner teams.

Harbor FAQ

The constraints that make outcome verification practical in production.

What makes Harbor different from a typical escrow?

Harbor is built around deterministic predicates and signed provenance. Funds move based on verifiable evaluation outcomes, not bespoke integrations or opaque operator decisions.

How do you keep predicates from becoming arbitrary code?

Predicates are evaluated in a bounded, fuel-metered environment and are designed to be deterministic. Harbor treats non-determinism as a failure mode, not a feature.

How does Harbor relate to Signal and the Ledger?

Harbor handles settlement decisions; the ledger anchors signed provenance for the settlement lifecycle; Signal produces operator-bound reputation receipts and rollups derived from that history.

Is Harbor multi-tenant?

Yes. Tenant identity is explicit throughout the flow. Operator tooling and exports are scoped to authenticated tenant context by default.