How it works

1. Request. An action that BROKER marks REQUIRE_APPROVAL (in the demo: any DELETE on an invoice) becomes a request: the action's SHA-256 digest, the named approvers, how many must say yes, an expiry. The requesting agent can never be an approver, in any capitalisation, and one person cannot be listed twice.
2. Ballots. Each approver gets one Ed25519-signed ballot, bound to the request, that approver and the action digest. A ballot works once; a refused vote (a typo, a closed request) does not use it up.
3. Vote. By the ballot link or a Slack button. Any DENY ends the request. Each approver counts once. Votes are recorded in one database transaction, so concurrent votes reach one outcome.
4. Receipt. When N have approved, CAIN signs an approval naming the approvers, the quorum and exactly the action. It is valid for at most 10 minutes.
5. Credential. BROKER accepts the approval once and mints one credential for exactly that method, path and body. The service accepts the credential once.
6. Ledger. Request, every vote and the outcome are appended to a SHA-256 chained, Ed25519-signed ledger.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.