Polivor documentation

Polivor is the authority layer for AI agents that act on money. Before an agent pays anything, it asks Polivor for authority for that one action. Polivor answers ALLOW, DENY or REQUIRE_APPROVAL, signs the answer, and records every check it made.

Polivor never holds, moves or initiates funds. It decides, signs and records. Your payment system, bank connection or ERP does the paying, and it checks Polivor's signature before it releases money.

How the pieces fit

1. The agent asks POST /v1/authorize with the exact payment it wants to make. It uses an agent API key.
2. Polivor checks who the agent is and which version it runs, the Financial Mandate the agent was given, the policy, the limits, and the beneficiary. Polivor computes these facts itself and never takes them from the agent.
3. Polivor answers. On ALLOW the answer contains a short-lived signed authorization, bound to that exact payment. On REQUIRE_APPROVAL a person decides first. On DENY there is no authorization, only reasons.
4. The enforcement point is your payment system. Before it releases funds it verifies the authorization with Polivor's public keys, and checks that the payment it is about to make matches the authorization exactly.
5. The enforcement point reports what happened (EXECUTED, REJECTED or FAILED). Polivor releases the reserved budget if the payment did not go out.
6. Evidence. Every decision and every state change is a signed, hash-chained record that you can verify offline, without trusting Polivor.

Where to go next

• Quickstart: get a decision, verify it and report the result.
• Concepts: the words used here, in one place.
• Authorize: the request, the answers, reasons and approvals.
• MCP server: the same two operations for agents that use the Model Context Protocol.
• Enforcement points: how to verify an authorization before releasing funds.
• Verify in Java, Go and .NET: tested code for the verification.
• Approvals and webhooks
• Evidence
• Mandates
• Errors and limits
• API reference, generated from the OpenAPI file.

The sandbox

Everything here runs in a sandbox today: synthetic data only, no real funds, best-effort availability. Read the sandbox terms. The sandbox API is at https://api.staging.polivor.com. A production endpoint is not available yet.