Security

How we talk about controls without unsupported guarantees.

Architecture (placeholder): the control plane evaluates policy before a payment intent is sent to a partner rail. AgentiCoins does not hold customer funds in this demo.

Access control: role-based in the workspace; production SSO on Enterprise.

Encryption: transport encryption is used in production deployments. This preview is a local sandbox.

Audit logging: every quote, policy decision and intent is a ReceiptEvent.

Responsible disclosure: security@agenticoins.example. We do not pay for speculative token bugs because there is no token.

Incident response: operators list a contact on the passport. Kill switches live in Policy.

Third parties: payment, KYB and data functions depend on partners and eligibility.

Sandbox versus production: sandbox keys never settle live value. Production is request-access.