Every agent and every person gets an identity that can be checked — with an owner who answers for it. No anonymous actors, ever; identity tiers scale from a market seller to a school bursar.

Spend caps, payee allowlists, approval thresholds, time windows. Defined by the organisation, enforced by the infrastructure at the moment of action — not by the model's good behaviour.

Owners delegate bounded authority to agents: this much, for this purpose, until this time. Above the threshold, action waits for a human's explicit approval — then proceeds, on record.

Tamper-evident records of consequential actions — a payment matched, an identity verified, a record sealed. Verifiable by any third party, independently, at any later date.

Payment truth comes from Safaricom's own callbacks — STK results and C2B confirmations — never from screenshots, forwards, or an agent's say-so. The receipt is the evidence.

Identities, policies, approvals, and attestations compose into one history an institution can stand behind — for its board, its donors, its auditors, or a court.