    Trust · part of the productProduct / 02
  

Agents can transact because the authority is provable.

Nobody hands spending power to software on the strength of good intentions. Every transaction resolves to an identified agent, acting for a known buyer, inside authority you can narrow or withdraw.

You would not hand a new hire an uncapped company card.
Nobody is asking you to hand one to software.

Authority you cannot withdraw is not authority.

Chain of authority

01 · BUYER

Known party

An enterprise, merchant, or individual, verified before any authority can be issued.

02 · RULES

Signed grant

Scope, cap, rules, expiry. Cryptographically signed and independently verifiable.

03 · AGENT

Identified actor

A registered agent identity with its own credentials, never a shared account or a browser session.

04 · TRANSACTION

Checked execution

Mandates, buyer policy, and supplier eligibility are all evaluated before money moves.

05 · EVIDENCE

Signed record

What was authorized, offered, decided, paid, and confirmed, retained and exportable.

Revocation, live

Authority you cannot withdraw is not authority.

A mandate is a signed, revocable permission to spend. Revoke the one below and watch the agent's next calls fail. Revocation propagates in under a second, mid-transaction, without needing the agent's cooperation.

          Mandates · mnd_4471{{ mandateState }}
        

buyer acme-corp · verified
agent agent_ent_44 · registered
scope hotel, rail
cap 4,200.00 USD
rules refundable=true, rate_class<=corp
expires 2026-08-01T00:00Z

{{ hint }}

          Agent call logapi.trustpixel.com/v2
        

              {{ cl.op }}{{ cl.res }}
            

{{ note }}

Controls

Ten controls, each enforced by infrastructure.

Identity and authority

Agent identity

Every agent is registered with its own credentials and operator record. Suppliers see who is transacting, not an anonymous client.

Delegated authority

Authority originates with a verified buyer and is expressed as a signed mandate. Agents cannot self-authorize or widen their own scope.

Rules that hold

What an agent may buy, up to what amount, and until when is checked on every single call: searching, choosing, buying, and every change afterwards.

Revocation

buyers revoke or narrow authority at any time, propagated in under a second, including during an open transaction.

Human escalation

Thresholds route a transaction to a person: price deltas, ambiguous eligibility, unusual velocity, or any rule the buyer marks as escalate-only.

Execution, money, and record

Supplier policy enforcement

Supplier rules are enforced with the same weight as buyer rules. Eligibility, allocation ceilings, and blackout rules cannot be bypassed by demand-side pressure.

Payment and data handling

Card data is handled in an environment built to PCI DSS Level 1 requirements, with certification in progress. Agents receive scoped, single-use instruments rather than stored credentials, and personal data passes only where the transaction requires it.

Auditability

Every decision is reconstructible: which offers existed, which rules excluded them, who selected what, and what the supplier confirmed.

Transaction evidence

Signed bundles are retained for the contractual period and exportable to finance, audit, and dispute workflows on both sides of the transaction.

Fraud prevention

Purchase-rate limits, unusual-spend detection, protection against reused offers, and the ability to suspend an individual agent operate at the exchange, before a request reaches a supplier.

Security and compliance posture

Documentation available under NDA · certifications in progress · updated 2026-07

CERTIFICATION

SOC 2 Type IIin progress

Audit in progress; controls implemented and monitored continuously.

PAYMENTS

PCI DSS Level 1in progress

Certification in progress. Card data isolated; tokenized instruments issued per transaction.

DATA

GDPR and CCPA

Data minimization by transaction purpose; regional processing available.

ENCRYPTION

TLS 1.3 · AES-256

In transit and at rest, with signed mandate and audit records.

ASSURANCE

Third-party testingscheduled

First independent penetration test scheduled; coordinated disclosure program open now.

AVAILABILITY

99.9% target

Multi-region transaction API. Service level committed contractually; incident history published to partners.

Request the security package Read the mandate reference