How it works

1. Define a tree: tenant, workflows, agents, each with a limit and optionally a spend rate (cents per window) and, for agents, a loop limit (the same call N times per window). Re-defining changes only these limits; spend and breaker state are kept (since 2026-11-02).
2. Charge. Every spend is one SQLite BEGIN IMMEDIATE transaction: the agent and every ancestor must have the budget left and stay under their rate; the agent must not repeat the same call too often.
3. Fail closed. An unknown agent, a missing ancestor, a malformed amount (negative, zero, NaN, a string, a boolean) or a store error is DENY. Nothing is charged unless every check passed.
4. Trip. A rate or loop breach trips the agent's breaker: every further charge is DENY, and the trip is written to a SHA-256 chained, Ed25519-signed ledger.
5. Reset. Only a reset signed by CAIN for that agent and that trip, used once, clears it.
6. Forecast. Status shows the burn rate and the time until each budget runs out.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.