Soterias

Bounded autonomy
for financial operations.

A warrant for every task. Authority outside the model. Proof against real state.

See the gap ↓

Default deny / Task-bound

Built for regulated finance

SOX
SEC
FFIEC
DORA
PCI DSS
FINMA

The problem

Agents moved from
answering to acting.

Payments. Bookings. Core changes. The question is no longer “is the text ok?”, it is what authority the agent may exercise.

Access ≠ authority

Identity and PAM open doors.

They do not bind a task, cut scope on delegation, or prove what changed.

Gap stays open

Prompts fail

Tickets and logs redirect tools.

82.5% unsafe actions under naive execution. Zero with an execution-time gate.

Adversarial by default

Logs ≠ proof

Auditors need what occurred.

Not that a call was requested, principal, decision, and verified effect.

Reviews need artefacts

The consequence

Risk blocks
scaling agents.

In finance an authorised effect is a payment or a production change, not a bad paragraph.

82.5%

Unsafe tool actions without a policy gate

arXiv:2607.10490

Orgs with full just-in-time privileged access

CyberArk · Jan 2026

45%

Treat AI agents like human users

CyberArk · Jan 2026

The approach

A warrant for
every task.

Each objective becomes a Task Capability Contract, scoped by a named principal, compiled into controls outside the model.

Default deny

No authority without this task. It expires with the warrant.

Argument-aware

Amounts, counterparties, accounts, not just tool names.

Attenuated delegation

Child authority ⊆ parent. Cryptographic, not prompt convention.

Proof of effect

Signed receipts checked against PSP, ledger, and core state.

Assume the model is compromised. Block unauthorised effect. Keep credentials out of context.

Evidence chain

Principal → task → effect.

Maps to change control, least privilege, and delegated consent.

Principal

Named human owns the warrant.

Task

Authority compiled into bounds.

Delegation

Child is a subset of parent.

Policy

Gate tools and arguments live.

Effect

Receipt vs provider state.

soterias / warrant-decision

14:07:23.847 principal: treasury-ops task: dispute-refund-4821 tool: psp.refund
args: amount=1200 counterparty=txn_verified_set DENIED
reason: amount exceeds task bound ($500) receipt: none _

Regulated finance

Artefacts reviews
accept.

Not compliance by logging. Evidence by chain, with counsel.

SOX ITGC

Attributable decisions. Immutable trail.

SEC / FFIEC

Provable effect for bank and disclosure reviews.

DORA ICT change

Principal → policy → verified effect.

PCI DSS

Least privilege on cardholder paths.

NYDFS / GLBA

Access, logging, and data-path controls.

Short-lived creds

Never in model context. Die with the task.

Whitepaper