Private architecture proposal, prepared for BitGo. Not a customer and not an endorsement.

An AI agent is about to move $250,000.
Can you prove it was allowed to?

BitGo proves the key was safe. Hive proves the decision was allowed. Those are two different jobs, and only one of them has ever had proof.

what the proof actually covers
The key was safe100%
The signature proves this. BitGo already nails it.
The decision was allowed0%
Nothing proved this. That is the gap.
Hive closes it. The decision is signed and provable, up to 100%.
NYSE: BTGOpublic since January 2026
BitGo Bank & Trust, N.A.full OCC approval, federally chartered
~$104B in custody1,550+ digital assets
ML-DSA-65FIPS 204, the standard you already chose
Key takeaways
  • BitGo proves the key was safe. Until now, nothing proved the decision was allowed.
  • Hive signs the decision before the money moves, and the proof cannot be changed later.
  • Anyone can re-check the proof offline, with no login and no callback.
what a signature does not prove

A signature says the key was safe.
It says nothing about the decision.

Which model asked?
not proven
What did it read?
not proven
Which rule did it pass?
not proven
Could a person have stopped it?
not proven

A signature proves the key was safe. It says nothing about the decision that moved the money. Hive proves the decision.

two jobs, one clear boundary

BitGo already answers the first question perfectly.
Until now, nobody answered the second.

Nothing here touches your keys, your MPC, or your cold storage. The decision receipt sits above the signature. It never competes with it.

● what BitGo proves today

The key was safe

BitGo holds the private keys and signs the transfer. The signature proves the key was never stolen or copied. That part is solid, and Hive does not touch it.

Was the key safe? Yes, provably.

● what only a decision receipt proves

The decision was allowed

Which model asked, what it read, which rule it passed before it acted, and whether the move was held or released. Signed as it happens, checkable later offline, with no login and no callback.

Should the agent have moved the money? Now provable too.
carnac™ · drag a slider, watch the risk and the receipt change

Bigger risk earns heavier proof.
Here is the proof it earns.

Move the two sliders. The risk bar reacts, the route changes when risk crosses a line, and a real receipt gets written on the right. That receipt is the whole point: it is signed before the money moves, and anyone can re-check it later.

How risky this move islow
routinereviewholdabstain
set a minimum:
Hive receiptROUTINE
Move$500
Oversighta person approves
Risklow
What it earnedroutine record
✓ signed before the money moved
proof id a1b2c3d4e5f6
✓ re-checkable offline, no login, no callback
The weighting behind the route is private. How Carnac™ sizes proof is trade secret and never leaves Hive. What ships to you is the route it chose and a receipt anyone can re-check offline. Two planes, kept apart on purpose. That separation is what makes the proof worth anything to a regulator.
one transfer, start to finish · auto-runs

What happens before the money moves

BitGo keeps custody the whole time. Hive runs beside it and proves the decision. Watch step four.

READY
Request forms
Risk measured
Floor set
Move held
Proof signed
Human decides
Custody acts
press ignition

The money never moves on a decision no one can prove.

the carnac™ family · on surfaces you already shipped · click each one

You built the agent surfaces.
Carnac™ proves what the agent decided on them.

BitGo already ships an agentic wallet, and in March 2026 launched an MCP Server so AI tools can work with BitGo in plain language. Both let a model reach toward value. Each reach becomes a signed record before anything moves.

carnac live ink™ · press replay

Your treasury team writes the rule.
The proof forms in the text, live.

When a risk officer writes an agent policy, each part is marked in the moment it is written, each carrying the route it earns. The record is built while the work happens, not rebuilt afterward.

routine review hold
● the detailed map · skim or skip · pick a bitgo surface

Which primitive proves which surface

Hive is a set of primitives, each with one job. All are available today. Connecting them to BitGo would be a scoped build inside your existing custody and wallet workflows. A developer can prove one connection in under an hour. One protected workflow takes one to three engineering days. A production pilot takes one to two weeks, because security review and change control still matter.

available capability
how BitGo can use it
platform value
one deployment path · all primitives available now

Start here, then expand across the platform

None of this asks you to touch the signing layer. You choose how far to spread it.

● start here

The signed decision receipt, running

  • Point one agentic wallet decision at it. No integration, no wallet, no login.
  • Back comes a signed decision, a risk level, and a verifiable group ID.
  • High-risk autonomous moves are refused at the weakest boundary.
parts · Carnac™ · CarnacPrompt™ · SiGR · Typed Signer ML-DSA-65
○ wire onto the wallet path

Beside the agentic wallet signature

  • The call is refused unless it presents valid signed clearance. Policy provably ran first.
  • Every tool call bound to a scope agreed in advance.
  • One grouped proof per decision, with no change to key custody.
parts · Carnac Gateway™ · Carnac Live Ink™ · Imprimatur · R3Pv
○ expand across the platform

Every surface, one proof fabric

  • Every mint, burn, and reserve move signed at the event. Twice a month becomes a steady stream.
  • The exam becomes a query. Signed bundles per question, checkable offline.
  • One fleet of receipts, where each regulator verifies only its own scope.
parts · SiGR · R3Pv fleet · Decision Ledger

The signature is the floor. Build the layer above it.

The next step is to scope one protected BitGo workflow with your agentic wallet engineering team. One question: does the decision receipt slot cleanly onto the agentic wallet path as the evidence layer above the signature? The proof already verifies offline, today, on the standard you already chose.

layer · above the signature, never competing standard · ML-DSA-65 · FIPS 204 proof · live · free tier · verifies offline
Private architecture proposal for BitGo · noindex / nofollow / noarchive · does not mean BitGo is a customer, partner, pilot, or endorser · the policy, transfer, and routing examples on this page show how the flow works and are not live BitGo data · you can run a real decision at /carnac/ · verification is always free and works offline against the Hive public key · Hive proves what an agent decided; it does not replace the custody, key-management, or signing layer beneath it · Hive states that a policy check ran and was signed, which is not a statement of legal compliance · Carnac™, CarnacPrompt™, Carnac Gateway™, and Carnac Live Ink™ are Hive marks · all Hive primitives patent pending · BitGo facts are source-reported and current as of July 2026 (NYSE listing; full OCC approval as BitGo Bank & Trust, N.A.; assets and asset count per IPO disclosure; MCP Server launch March 2026; agentic wallets) and should be re-verified before any external use · private by design: Hive does not store your prompts. Every request is receipted by a one-way SHA-256 fingerprint, not the words · proof, not surveillance · Hive Civilization Inc. · Wyoming, USA
new in the canon · runnable on this page

Put withdrawal authority beside custody proof

These receipts add a narrow record of whether a proposed withdrawal fit the authority assigned to it, plus a separate check of the supplied withdrawals against one shared limit. They run in production today. The examples below are verified live against them.

mandate.conformance · Deployed in production

Check a custody withdrawal against one delegated authority

Use this receipt when a wallet agent or operator presents one withdrawal for review. It compares the withdrawal amount, currency, timing, and scope with the constraints in one delegated authority receipt signed before that withdrawal was authorized. The service recomputes the result from those records instead of accepting a claimed result. That gives custody operations, risk, and legal a focused statement about the action and the authority supplied with it. It can sit above the signature and policy engine without changing key control or cold storage.

What it does not do. It does not prove that the delegation was granted, that the agent identity is genuine, that a network authorized or settled the withdrawal, that value was delivered, or that anyone read the displayed terms. It is not payment authorization and carries no cardholder credential; no card network, issuer, or regulator recognises it as authentication data, compelling evidence, or a liability shift; it cannot decide a dispute, limit rights under Regulation E, Regulation Z, or an equivalent rule, assess cumulative spend or velocity, or show that the supplied authority remained unrevoked when the withdrawal was authorized.

POST /verify/mandate-conformance · case pass, a clean record

Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.

POST /verify/mandate-conformance · case fail, a forged record

Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.

mandate.aggregate · Deployed in production

Test supplied withdrawals against one shared custody limit

This receipt brings a supplied set of withdrawal conformance receipts into one review window. It checks that they name the same delegated authority, use one currency, fall inside the stated period, and contain no duplicate. The service recomputes the count and total in minor units, then compares both with the stated cumulative constraint. That helps treasury and policy teams inspect a batch of actions instead of relying on a handwritten total. A failed run makes the excess or invalid set visible before it becomes a loose end for risk or legal.

What it does not do. It cannot know whether every withdrawal was supplied, so a result within the limit describes only the receipts presented and not all spending by the authority holder. It performs no currency conversion, is not payment authorization, creates no card network liability shift, and does not limit rights under Regulation E, Regulation Z, or an equivalent rule.

POST /verify/mandate-aggregate · case pass, a clean record

Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.

POST /verify/mandate-aggregate · case fail, a forged record

Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.

Every run above posts a verified request body from this domain to the open verify route and prints what came back. The example receipts are signed with published example keys, so verify reports key_trust example_registry. That is on purpose. Nothing on this page is a production issuance, a customer record, or an endorsement. Patent Pending.