How HalvorAI works

HalvorAI turns every payment your AI agents make into a record a bank can rely on. It does this after the payment, from signed events your code sends.

Note

HalvorAI is not in the payment path. It never authorizes, delays, approves or blocks a payment, and a HalvorAI outage cannot affect your payments. It records and monitors.

The pipeline

1. Your agent pays. On Stripe, x402, MPP, a card, or through an MCP tool. Nothing about this changes.
2. The SDK emits an event. An adapter turns the rail’s own objects into an Agent Payment Event, adds the agent, owner and instruction, strips card numbers and secrets, signs it with your source key, and sends it in the background.
3. Ingest checks and chains it. The API validates the event against the schema, checks the signature against your registered key, rejects anything that looks like a card number, and links it into a per-organization hash chain so nothing can be removed later without detection.
4. Evidence is verified. Mandates (AP2, Mastercard Verifiable Intent), Visa TAP signatures and x402 payloads attached to the event are checked, and the payment is compared with the limits the owner’s mandate set. See evidence and verification.
5. The payee is screened. Names and wallet addresses are checked against sanctions lists. See sanctions screening.
6. Detectors watch behaviour. Each agent gets a baseline from its own history, and detectors flag loops, spikes, new payees and drift. See detectors and alerts.
7. You review. Alerts and screening matches go to a review queue. Related items are grouped into a case.
8. Your bank gets an evidence pack. A signed bundle with the events, proofs, results and a timeline, that the bank can check offline. See cases and evidence packs.

What HalvorAI does not ask you for

HalvorAI never asks you to type spending limits. Limits come from the network credentials that already carry them, such as an AP2 or Verifiable Intent mandate, and HalvorAI reads them from the evidence on each payment.

Who uses what

Person	Uses
Developer	SDKs, API keys, the API, validation
Risk or compliance lead	Alerts, screening review, cases, evidence packs, the five coverage metrics
Sponsor bank reviewer	A shared link or zip, and offline verification

Where to go next

Follow the quickstart, or read about the environments first.