The governance layer between autonomous actors and the XRP Ledger. Every action is checked against policy before anything signs, and the ledger itself rejects what the policy did not approve.
Every action starts as an intent.
Policy decides before anything signs.
The ledger requires both signatures.
Every approved action leaves a receipt.
Anyone can verify it. Offline.
The kernel's reference demo, replayed: three intents against a DUNA treasury policy. Receipt hashes are from a real run; the demo mocks XRPL submission.
SovereignGate sits between autonomous actors and the ledger. Every financial action from an AI agent, DAO, or DUNA treasury is checked against declared policy, signed into a tamper-evident receipt, and co-signed at the XRPL protocol level before it can execute.
Three shifts in the past year turned governance for autonomous money from a feature into a requirement.
Wyoming recognized the Decentralized Unincorporated Nonprofit Association in 2024. Alabama's DUNA law takes effect October 1, 2026, and more states have bills moving. A DUNA can hold a treasury and sign contracts, but nothing in the statute shows a member or a court that the treasury followed its bylaws.
Source: The BlockCoinbase shipped Agentic Wallets in February. In June, Ripple released the XRPL AI Starter Kit for agent payments in XRP and RLUSD, and Mastercard named RippleX a launch partner for Agent Pay for Machines. Spending limits exist now, but they live inside each provider, and so does the record of what they decided.
Source: PYMNTSa16z crypto's 2026 outlook called KYA “the critical missing primitive”: signed credentials that bind an agent to its principal, its constraints, and its liability. SovereignGate is where those constraints are enforced, with a receipt left behind every decision.
Source: a16z cryptoThe pipeline is the product. Each stage trusts nothing it receives from the stage before it.
An agent submits a SovereignIntent: operation, parameters, entity, agent, and a single-use nonce, over an authenticated REST API.
SovereignIntentThe Fact Origin Attestation Validator classifies risk from the operation's own semantics. A caller's claim can raise the tier. It can never lower it.
max(claimed, inferred)A content-addressed PolicyBundle evaluates every rule. First DENY wins, ALLOW never short-circuits, and a parse failure is a DENY. It always fails closed.
PolicyBundleA passing intent gets an Ed25519-signed AllowArtifact. The type cannot be constructed outside the gate crate, and the Rust compiler enforces that.
AllowArtifactThe adapter verifies the artifact's signature and intent binding, consumes the nonce atomically, then adds the governance signature the SignerList requires.
SignerList quorumA DetGateReceipt joins an append-only, hash-chained ledger with periodic Merkle roots. The format is wire-compatible with SovereignClaw receipts.
DetGateReceipt// No layer trusts the layer above. core zero deps IR schema, canonical hashing crypto core Ed25519, SHA-256, JCS gate core, crypto policy engine, sealed artifact receipt core, crypto receipts, Merkle, append-only xrpl gate, receipt multi-sign, nonce replay guard gateway xrpl, receipt HTTP API (Axum), full pipeline
At provisioning, the governed account's master key is disabled and a SignerList is set: agent weight 1, governance weight 1, quorum 2. From then on, every XRPL validator rejects a transaction unless both keys sign it.
SovereignGate's key signs only a transaction that carries a sealed AllowArtifact. The gate has no admin override and no API bypass, because a bypass would have to convince the ledger.
Want a way out if the gate is ever unreachable? Provision the three-signer list instead: agent 1, governance 2, and an offline recovery key 2, quorum 3. The recovery key and the agent together clear quorum without the gate, so an outage never freezes the treasury. That break-glass path carries no receipt, but every signature on it is public on the XRP Ledger.
tefBAD_QUORUMSignatures do not reach quorum. Every validator rejects the transaction.
Eight invariants, each enforced in code and property-tested at 10,000 cases. Each one is a plate on the core: point at an invariant to lift it, or at an attack to fire it.
Prevents Privilege escalation through rule ordering
First DENY wins. ALLOW never short-circuits.
Prevents An LLM lying about risk
Tier comes from operation semantics only.
Prevents Tier downgrade attacks
max(claimed, inferred), always.
Prevents Unauthorized governance changes
Blocked before policy evaluation runs.
Prevents Transaction replay
Atomic INSERT OR IGNORE.
Prevents Reusing an artifact across entities
Signature, hash, entity and agent all verified.
Prevents Hash collisions from key reordering
Recursive key sort, property-test proven.
Prevents Evidence tampering
No UPDATE or DELETE on the ledger. Ever.
Entity policies are written in a deterministic rule language. Rules are data, not code, and every policy bundle is content-addressed with SHA-256, so any change produces a new bundle ID that each receipt records. Policies hot-reload over the API, and a bundle that fails to parse denies everything.
Amounts are integers in micro-USD (1 USD = 1,000,000), so limits compare exactly at the boundary. No floating point, no rounding.
// DUNA treasury governance RULE max_single_transaction WHEN params.usd_equivalent_micro > 10000000000 THEN DENY "Exceeds $10,000 DUNA limit" RULE permitted_assets WHEN params.asset NOT IN ["XRP", "USD", "RLUSD"] THEN DENY "Asset not in permitted list" RULE business_hours_only WHEN context.hour < 6 OR context.hour > 22 THEN ESCALATE threshold=2 operators=["admin_1", "admin_2"]
Median for a full gate decision, including canonical intent hashing and the Ed25519 artifact signature. Measured on allow, policy-block and T3-block paths, 10,000 runs each, release build.
We ran SovereignGate's own authorization function inside the Jolt zkVM with the lattice-based Akita commitment scheme. Every proof verified, and every output we tampered with was rejected.
Research benchmark, September 14, 2026. It shows feasibility; it is not yet part of the shipping product.
Tests across the Rust workspace, including an adversarial suite that attacks each of the eight invariants, plus property tests at 10,000 generated cases per invariant.
Custody and signing platforms check a transaction before they sign it. SovereignGate does that too, then makes the ledger itself refuse anything unapproved and leaves evidence that someone who trusts neither party can verify.
| Capability | SovereignGate | Signing-platform policy enginesFireblocks, Turnkey, Coinbase Agentic Wallets |
|---|---|---|
| Policy checked before signing | Yes, with deterministic rules | Yes |
| Where a “no” is enforced | The ledger itself: SignerList quorum, master key disabled | Inside the provider's MPC or enclave, which declines to sign |
| Evidence of each decision | Ed25519-signed, hash-chained receipt anyone can verify offline | Activity and audit logs inside the provider's platform |
| Policy versioning | Content-addressed: every bundle has its own SHA-256 ID | Managed in the provider's console or API |
| Built for legal entities | Bylaws-as-code for DUNA and DAO treasuries | General-purpose spend controls |
| Risk tier from the agent's own claim | Never. Claims can only raise the inferred tier | Rules match transaction fields |
Based on each provider's public documentation as of October 2026. They are custody and signing platforms; SovereignGate is a governance layer.
SovereignGate is in private development. Access opens first to DUNA operators, AI agent builders, and institutional partners.
One email when your cohort opens. Nothing else.
Partnerships, integrations, and investment conversations.