The memo

Software agents have started paying for things. Most of it is small: median machine payments across the main schemes are measured in cents, and reported real volumes are modest.^[1] The bet is that the amounts become consequential, and that when they do, no institution will let an agent move money it cannot bound in advance, pause before submission, and account for afterwards. Cartulary is an experiment in providing that control and that record.

The demand signals are large but secondhand: Gartner projects that agents will intermediate more than $15tn of B2B spend by 2028,^[2] and around four in five organisations deploying agents report no mature governance for them.^[3] Projections are not revenue. What is not secondhand is the regulatory direction. The proposal includes a twelve-month implementation period after final rules, but neither the timing nor the final scope is fixed.

Four external protocols define how an agent pays, and we carry one illustrative ledger-native design of our own beside them. They are not equivalents: some supply signed mandates, some supply checkout tokens, some supply metered sessions. The standard records precisely what each supplies and what it does not. None of them decides whether a given payment should happen inside an organisation's rules, and none supplies the complete institution-specific policy, investigation, and examiner-facing record being explored here, although AP2 does include an evidence trail by design. The prototype tests whether a separate layer is needed for that, or whether it belongs inside the transaction.

FinCEN and OFAC's proposed rules under the GENIUS Act would require permitted payment stablecoin issuers to run an effective sanctions compliance programme and to be able to block, freeze, and reject unlawful transactions, in certain secondary-market circumstances as well as at issuance. They do not propose a blanket secondary-market reporting obligation.^[4] The effective date Treasury proposes is twelve months after final rules are issued, and that date is part of the proposal rather than a fixed one.^[5] An institution that starts building when the rule is final will be building late. A full programme is larger than any one product: due diligence, monitoring, reporting, independent testing, and training. Cartulary supplies part of its working fabric, the decision, case-management, and evidence layer, built in the open before the deadline exists.

A decision on every submitted payment before settlement: allow, hold, or refuse, evaluated against the agent's mandate and the organisation's signed policy. The simulator includes scripted screening; live requests record not_screened. Every step is an append-only receipt, hash-chained and recomputable by anyone holding it, readable four ways: operator, auditor, examiner, and counterparty. An unresolved alert is never forced into a binary; investigation is a first-class disposition with its own deadline.

It is neutral three ways. Across protocols: each authority object is normalised into one policy model and shown beside its native form. Across instruments: stablecoins and tokenised bank deposits sit under a common policy envelope while preserving instrument-specific legal, credit, redemption, finality, and issuer-control characteristics. They are not interchangeable, and the memo does not pretend they are. Across data: the proposed screening design would ingest sanctions lists from their public sources and accept attribution and KYC through adapters, so that vendors feed the decision without ever making it. Neither the screening engine nor those adapters is built.

Not a wallet, not custody, never in possession of funds. Not a data vendor. Not yet a production service: the simulated environment is open to everyone and labelled as such on every screen; the live environment is open for organisations to govern real decisions, and settles USDC on Base Sepolia at test value. Production settlement, screening, and the Canton adapter are not built. Closing the gap between a test-value rail and a regulated production deployment is the work still to be done.

Cartulary sits beside the rail, never in the flow of funds. Institutional settlement networks already accommodate compliance checks inside multi-step transfers,^[6] so some controls may belong inside the transaction and others in an institution-local system. Which belongs where is the open question. The adapter note describes how an approved decision would bind to a prepared ledger transaction, carrying the mandate, policy version, and rules hash with it, none of which is built, without centralising what such ledgers deliberately partition.

The way to judge this project is not this memo. The roadmap is public, hosted features are marked built only when they run here and separate experiments only when they have a reproducible implementation and a recorded run, scope cuts are recorded rather than deleted, and the schema is published for anyone to implement without us. Judge the pace and the honesty there.