{"object":"trust_centre","generated_at":"2026-10-27T15:02:22.113Z","sha256":"074fdcd2bec1c89c4daa759312c2a768fdae7277bd8dd1ffaeab1d4eb87a375a","sections":[{"id":"architecture","title":"Architecture attestation","summary":"What AGORA's architecture guarantees about payment data, the evidence for each control, and live checks run when this page was generated.","source":"compliance/api.ts architectureAttestation() + live checks","available":true,"data":{"checks":[{"control":"Evidence chains verify (R4)","result":"8 of 8 merchant chains verified, 1706 records checked","ok":true},{"control":"Tenant isolation (R8)","result":"56 collections checked, 0 cross-tenant rows","ok":true},{"control":"AI disclosure text in force (R11)","result":"This is an automated agent operated by Fondaq.","ok":true}],"attestation":{"format":"agora.architecture-attestation/v1","demo":true,"generated_at":"2026-10-27T15:02:22.113Z","statement":"AGORA never receives, stores, processes or transmits primary account numbers, card verification values or full payment credentials (R1). The merchant is merchant of record and its PSP confirms every payment (R2). AGORA handles only PSP token references, handler identifiers and mandate hashes (payment-adjacent data), pinned to the merchant's region without exception.","scope":{"cardholder_data_environment":"not in scope for AGORA systems","payment_adjacent_fields":[{"entity":"order","field":"psp_ref"},{"entity":"order","field":"mandate_refs"},{"entity":"checkout","field":"mandate_refs"},{"entity":"checkout","field":"handler_id"},{"entity":"checkout","field":"token_ref"},{"entity":"checkout","field":"payment_handler"},{"entity":"booking","field":"deposit"},{"entity":"booking","field":"payment_schedule_ref"}],"payment_adjacent_keys":["psp_ref","mandate_refs","mandate_hash","handler_id","token_ref","payment_handler","payment_token","spt_ref","delegated_payment_ref","deposit","payment_schedule_ref","insurance_member_ref"]},"controls":[{"id":"pan_guard_adapters","mechanism":"adapters reject PAN-shaped values before processing","evidence":{"file":"server/src/modules/commerce/pan.ts","present":false}},{"id":"pan_scan_ci","mechanism":"Luhn-valid digit-run scan over code and fixtures in CI","evidence":{"file":"scripts/scan-pan.mjs","present":false}},{"id":"event_bus_pan_reject","mechanism":"the event bus refuses envelopes with PAN-shaped values","evidence":{"file":"server/src/modules/platform/events/bus.ts","present":false}},{"id":"span_scrubber","mechanism":"span attributes are scrubbed (PAN, credentials, payment-adjacent keys)","evidence":{"file":"server/src/modules/observe/scrub.ts","present":false}},{"id":"model_scrubber","mechanism":"payment-adjacent data never reaches prompts or model logs (scrubForModel)","evidence":{"file":"server/src/modules/compliance/dataclass.ts","present":false}},{"id":"handoff_redirect","mechanism":"the handoff page redirects to the merchant's own checkout and renders no payment fields","evidence":{"file":"server/src/protocols/handoff.ts","present":false}},{"id":"token_references_only","mechanism":"every stored PSP reference is a token reference","evidence":{"check":"orders.psp_ref token-shaped","ok":true,"orders":709}}],"psps_in_use":["adyen","checkout_com","stripe"],"checkout_modes":{"protocol_checkout":6,"handoff":25,"bookings_only":11},"region_pins":[{"merchant_id":"01M58QAF02PNHVGYH0Q4V0GD26","region":"uae-1"},{"merchant_id":"01M58QAF03JXMNA13J0WEZTHD9","region":"uae-1"},{"merchant_id":"01M58QAF04DW9GGXFRKWNV5BR5","region":"uae-1"},{"merchant_id":"01M58QAF05A31E6HSX5GCW8PEX","region":"uae-1"},{"merchant_id":"01M58QAF06K8SV4BBZSAA0J8W2","region":"uae-1"},{"merchant_id":"01M58QAF07G94GRWQVWZQD0SY0","region":"eu-1"},{"merchant_id":"01M58QAF08W11F0V0SG5SEMWQP","region":"us-1"},{"merchant_id":"01M5YP50H7GT9NZHN45FHQPQ4D","region":"eu-1"}],"signature":{"alg":"Ed25519","kid":"e73dQEEa-6gd69GlVZGjB0QvKktjOFomeVq98HDUj-I","canonicalization":"agora-stable-json","value":"qAIax64nXLhgUCWyd8AW9Gsikyb1sHHL8alUVhPFmglpCXZvmj6iVltx1yVeLlBR0xrTrVDaMtkjRqCvE6vYDg"}}}},{"id":"tpsp","title":"TPSP responsibility matrix","summary":"Who is responsible for each payment-security requirement: AGORA, the business, or its PSP.","source":"compliance/api.ts tpspMatrix()","available":true,"data":{"format":"agora.tpsp-matrix/v1","standard":"PCI DSS v4.0 (responsibility split, DEMO)","generated_at":"2026-10-27T15:02:22.150Z","psps_in_use":["adyen","checkout_com","stripe"],"protocol_checkout_in_use":true,"rows":[{"requirement":"1","title":"Network security controls","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"2","title":"Secure configurations","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"3","title":"Protect stored account data","agora":"not applicable: AGORA stores and transmits no account data","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"4","title":"Protect cardholder data in transmission","agora":"not applicable: AGORA stores and transmits no account data","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"5","title":"Protect against malicious software","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"6","title":"Secure systems and software","agora":"responsible for the site SDK and handoff page served onto merchant pages (SRI-pinned, no payment fields)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"7","title":"Restrict access by business need to know","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"8","title":"Identify users and authenticate access","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"9","title":"Restrict physical access to cardholder data","agora":"not applicable: AGORA stores and transmits no account data","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"10","title":"Log and monitor access","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"11","title":"Test security regularly","agora":"responsible for AGORA systems (payment-adjacent data only)","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"responsible for its own website and PSP integration (merchant of record)"},{"requirement":"12","title":"Information security policies and programmes","agora":"shared: AGORA's security programme for its services; TPSP list and this matrix published","psp":"responsible for the payment environment (adyen, checkout_com, stripe)","merchant":"maintains its TPSP list including AGORA and its PSP"}]}},{"id":"residency","title":"Data residency","summary":"Where tenant data lives, which data classes never leave their region, and how an exception is approved.","source":"compliance/api.ts publicResidency()","available":true,"data":{"regions":["uae-1","eu-1","us-1"],"storage_path_rule":"{region}/{tenant_id}/{collection}/{merchant_id}/{key}","note":"Projections may be published globally through the CDN; every other write is pinned. Cross-region movement requires an exception on the tenant record.","class_rules":[{"data_class":"public","residency":"global","exception_possible":false},{"data_class":"business","residency":"pinned","exception_possible":true},{"data_class":"personal","residency":"pinned","exception_possible":true},{"data_class":"payment_adjacent","residency":"no_exception","exception_possible":false},{"data_class":"phi","residency":"no_exception","exception_possible":false},{"data_class":"intake_confidential","residency":"pinned","exception_possible":true},{"data_class":"evidence","residency":"pinned","exception_possible":true}],"tenants_per_home_region":{"uae-1":1,"eu-1":1,"us-1":1}}},{"id":"sub-processors","title":"Sub-processors","summary":"Third parties that process customer data on AGORA's behalf, generated from the deployed connectors.","source":"compliance/api.ts subProcessors()","available":true,"data":{"version":"1.0.0","generated_from":"deployed connectors (platform connections, PSP, CRM, ESP, syndication, booking feeds, verification)","items":[{"id":"hosting","vendor":"Demo VPS host (single region)","purpose":"application hosting (demo)","data_classes":["business","personal","payment_adjacent","phi","intake_confidential","evidence"],"regions":["eu-1","uae-1","us-1"],"kind":"core","used_by_merchants":8},{"id":"edge","vendor":"Cloudflare","purpose":"trust-edge Worker, CDN for projected (public) content","data_classes":["public"],"regions":["global"],"kind":"core","used_by_merchants":8},{"id":"adyen","vendor":"Adyen","purpose":"payment service provider (token references only)","data_classes":["payment_adjacent"],"regions":["us-1"],"kind":"connector","used_by_merchants":1},{"id":"checkout_com","vendor":"Checkout.com","purpose":"payment service provider (token references only)","data_classes":["payment_adjacent"],"regions":["uae-1"],"kind":"connector","used_by_merchants":1},{"id":"fifini","vendor":"Fifini (KYC/KYB provider, demo mock)","purpose":"age and identity verification; outcomes only, documents never stored","data_classes":["personal"],"regions":["uae-1"],"kind":"connector","used_by_merchants":2},{"id":"gmc","vendor":"Google Merchant Center","purpose":"product feed delivery","data_classes":["public"],"regions":["uae-1","us-1"],"kind":"connector","used_by_merchants":2},{"id":"hubspot","vendor":"HubSpot","purpose":"lead delivery to the merchant CRM","data_classes":["personal","intake_confidential"],"regions":["uae-1"],"kind":"connector","used_by_merchants":1},{"id":"klaviyo","vendor":"Klaviyo","purpose":"email service provider (machine blocks; consented marketing)","data_classes":["personal"],"regions":["eu-1","uae-1","us-1"],"kind":"connector","used_by_merchants":7},{"id":"rwg","vendor":"Google (Reserve with Google)","purpose":"booking feeds and booking server","data_classes":["business","personal"],"regions":["uae-1"],"kind":"connector","used_by_merchants":4},{"id":"salesforce","vendor":"Salesforce","purpose":"lead delivery to the merchant CRM","data_classes":["personal"],"regions":["eu-1"],"kind":"connector","used_by_merchants":1},{"id":"shopify","vendor":"Shopify","purpose":"catalogue and order import (merchant platform)","data_classes":["business","personal"],"regions":["uae-1"],"kind":"connector","used_by_merchants":1},{"id":"stripe","vendor":"Stripe","purpose":"payment service provider (token references only; merchant of record)","data_classes":["payment_adjacent"],"regions":["eu-1","uae-1"],"kind":"connector","used_by_merchants":4},{"id":"webhook","vendor":"Merchant-operated webhook endpoint","purpose":"lead delivery","data_classes":["personal"],"regions":["uae-1"],"kind":"connector","used_by_merchants":3},{"id":"woocommerce","vendor":"WooCommerce (merchant-hosted)","purpose":"catalogue and order import (merchant platform)","data_classes":["business","personal"],"regions":["us-1"],"kind":"connector","used_by_merchants":1},{"id":"zoho","vendor":"Zoho CRM","purpose":"lead delivery to the merchant CRM","data_classes":["personal"],"regions":["uae-1"],"kind":"connector","used_by_merchants":1}],"unmapped":[]}},{"id":"ai-systems","title":"AI systems","summary":"Every AI system AGORA provides or deploys, with how people are told and how output is marked.","source":"compliance/api.ts aiSystemInventory() (policies/compliance/ai-systems.yaml); JSON at /v1/trust/ai-systems","available":true,"data":{"disclosure_text":"This is an automated agent operated by Fondaq.","systems":[{"id":"ais-lab-runner","feature":"Agent Lab mission runners (browser and API runners acting as shopping agents)","role":"deployer","model_tasks":"lab.run_mission, lab.classify_transcript","disclosure":"inject_free_text","marking":"not_applicable","last_reviewed":"2026-10-26"},{"id":"ais-synthetic-runner","feature":"Synthetic research studies (population-level persona simulation)","role":"provider","model_tasks":"synthetic.respond, synthetic.report","disclosure":"label","marking":"metadata","last_reviewed":"2026-10-26"},{"id":"ais-visibility-runner","feature":"Visibility runners (answer-engine sampling and answer parsing)","role":"deployer","model_tasks":"visibility.sample, visibility.parse_answer","disclosure":"declared_ua","marking":"not_applicable","last_reviewed":"2026-10-26"},{"id":"ais-content-studio","feature":"Content Studio (generated assets under the kernel gate) and generated feed descriptions / app copy","role":"provider","model_tasks":"content.compose, content.kernel_check, content.translate","disclosure":"label","marking":"manifest","last_reviewed":"2026-10-26"},{"id":"ais-brand-agents","feature":"Branded agents (merchant chat agents generated from the graph and kernel)","role":"provider","model_tasks":"brand_agent.converse","disclosure":"first_turn","marking":"metadata","last_reviewed":"2026-10-26"},{"id":"ais-chat-surfaces","feature":"AGORA-operated chat surfaces (console assistant over agora://console, storefront and continuity chat)","role":"provider","model_tasks":"console.assist","disclosure":"first_turn","marking":"metadata","last_reviewed":"2026-10-26"},{"id":"ais-classify-business","feature":"Business classification at sign-up (pack.classify_business)","role":"provider","model_tasks":"pack.classify_business","disclosure":"label","marking":"metadata","last_reviewed":"2026-10-26"},{"id":"ais-review-summaries","feature":"Review summaries and response drafts (earned signals)","role":"provider","model_tasks":"earned.summarise_reviews, earned.draft_response","disclosure":"label","marking":"manifest","last_reviewed":"2026-10-26"},{"id":"ais-kernel-extraction","feature":"Brand-kernel statement extraction and claim checks","role":"provider","model_tasks":"kernel.extract, kernel.claim_check","disclosure":"label","marking":"not_applicable","last_reviewed":"2026-10-26"},{"id":"ais-call-agents","feature":"Fondaq Calls (AI phone agents that call and answer for the business; the first line of every call says the agent is automated)","role":"provider","model_tasks":"calls.agent_turn, calls.summarize","disclosure":"first_turn","marking":"metadata","last_reviewed":"2026-10-27"},{"id":"ais-social-content","feature":"Fondaq Marketing social publishing (AI content calendar, posts, captions in the business's languages, brand-safe generated images; never a real person)","role":"provider","model_tasks":"social.compose_post, brand.claim_check","disclosure":"label","marking":"manifest","last_reviewed":"2026-10-27"},{"id":"ais-social-replies","feature":"Fondaq Marketing comment and message triage (classification, reply drafts from approved statements; a person approves every reply, which carries the AI disclosure)","role":"provider","model_tasks":"social.classify_comment, social.draft_reply","disclosure":"inject_free_text","marking":"metadata","last_reviewed":"2026-10-27"},{"id":"ais-ads-manager","feature":"Fondaq Marketing ads manager (campaigns from a goal, AI-drafted creatives and audiences, guarded auto-optimisation inside hard spending caps)","role":"provider","model_tasks":"ads.draft_campaign, brand.claim_check","disclosure":"label","marking":"manifest","last_reviewed":"2026-10-27"},{"id":"ais-business-architect","feature":"Fondaq Business Architect and AI team (plans which AI team members, apps and flows a business should use, shown labelled with its provenance; the team members act only through flows and calls, which carry their own disclosure and marking)","role":"provider","model_tasks":"agents.architect","disclosure":"label","marking":"metadata","last_reviewed":"2026-10-27"},{"id":"ais-concierge","feature":"Fondaq concierge (the website assistant on a business's own site and the conversational endpoint for agents that talk) and AI-drafted website journeys; answers only from the business's approved facts with citations, runs on Fondaq's own model once it passes the concierge evaluation gate, else on the deterministic grounded stand-in; journeys go live only after a person approves them","role":"provider","model_tasks":"concierge.answer, journeys.draft","disclosure":"first_turn","marking":"metadata","last_reviewed":"2026-10-27"}]}},{"id":"soc2","title":"SOC 2 status","summary":"The SOC 2 Type II control map to the running system, and where the observation window stands.","source":"compliance/api.ts soc2Status()","available":true,"data":{"version":"1.0.0","observation_window":{"opens_at_gate":"G2","status":"not_opened","auditor":"DEMO-Audit LLP (fictional)"},"controls":[{"id":"CC1.4","tsc":"Control environment","title":"Engineering guardrails are documented and enforced","mechanism":"CLAUDE.md hard rules R1-R14; CI gates per PR","evidence":"ci_gates","owner":"DevOps","frequency":"per_change","evidence_ok":false},{"id":"CC2.2","tsc":"Communication","title":"Sub-processors and AI systems are disclosed","mechanism":"trust centre generated from the system inventory","evidence":"trust_centre","owner":"Compliance","frequency":"per_deploy","evidence_ok":true},{"id":"CC3.2","tsc":"Risk assessment","title":"Jurisdiction risk is evaluated before surfacing restricted offerings","mechanism":"jurisdictionGate on every path (R12)","evidence":"jurisdiction_gate","owner":"Compliance","frequency":"continuous","evidence_ok":true},{"id":"CC5.2","tsc":"Control activities","title":"Policy-as-code for agent access and eligibility","mechanism":"Cedar policy packs under /policies","evidence":"policy_artefacts","owner":"Security","frequency":"per_change","evidence_ok":true},{"id":"CC6.1","tsc":"Logical access","title":"Tenant isolation on every record and route","mechanism":"tenant_id on every record; route-level tenant check (R8)","evidence":"tenant_isolation","owner":"Security","frequency":"continuous","evidence_ok":true},{"id":"CC6.6","tsc":"Logical access","title":"Inbound agent traffic passes the trust edge","mechanism":"trust-edge middleware on protocol routes (R3)","evidence":"trust_edge","owner":"Security","frequency":"continuous","evidence_ok":false},{"id":"CC6.7","tsc":"Logical access","title":"Sensitive data classes are encrypted with per-tenant keys","mechanism":"AES-256-GCM, HKDF per tenant and data class (ADR-016)","evidence":"tenant_keys","owner":"Security","frequency":"continuous","evidence_ok":true},{"id":"CC6.8","tsc":"Logical access","title":"Malicious code and vulnerable patterns are blocked","mechanism":"Semgrep SAST, secret and PAN scans in CI (ADR-015)","evidence":"sast","owner":"Security","frequency":"per_change","evidence_ok":false},{"id":"CC7.2","tsc":"System operations","title":"Security events are logged immutably","mechanism":"hash-chained audit log, per-agent-action audit with 5-year retention","evidence":"audit_chain","owner":"Security","frequency":"continuous","evidence_ok":true},{"id":"CC7.3","tsc":"System operations","title":"Evidence chain integrity is verified on a schedule","mechanism":"nightly evidence verifier","evidence":"evidence_verifier","owner":"Security","frequency":"daily","evidence_ok":true},{"id":"CC8.1","tsc":"Change management","title":"Changes pass review and CI before deploy","mechanism":"branch protection, required checks, event-schema compatibility gate","evidence":"ci_gates","owner":"DevOps","frequency":"per_change","evidence_ok":false},{"id":"C1.1","tsc":"Confidentiality","title":"Confidential classes never reach logs, captures or prompts","mechanism":"scrubForModel + span scrubber; PHI scrubber tests in CI","evidence":"scrubber","owner":"Security","frequency":"per_change","evidence_ok":true},{"id":"C1.2","tsc":"Confidentiality","title":"Retention schedules are enforced","mechanism":"retention schedules per data class; purge job","evidence":"retention","owner":"Compliance","frequency":"daily","evidence_ok":true},{"id":"P4.2","tsc":"Privacy","title":"Consent per channel with withdrawal evidence","mechanism":"consent records per channel; propagation <= 60 s","evidence":"consent","owner":"Compliance","frequency":"continuous","evidence_ok":true},{"id":"P5.1","tsc":"Privacy","title":"Data-subject requests across services","mechanism":"DSR export/delete across every store; drill","evidence":"dsr","owner":"Compliance","frequency":"monthly","evidence_ok":true},{"id":"PI1.3","tsc":"Processing integrity","title":"Generated content carries AI marking","mechanism":"marking manifest verified before publish (R11)","evidence":"marking","owner":"AI engineering","frequency":"per_change","evidence_ok":true},{"id":"A1.2","tsc":"Availability","title":"Data residency is enforced per region","mechanism":"RegionalStore residency guard; PHI and payment-adjacent pinned without exception","evidence":"residency","owner":"DevOps","frequency":"continuous","evidence_ok":true}],"passing":13,"total":17,"iso42001":{"standard":"ISO/IEC 42001:2023 (AI management system)","assessed_at":"2026-10-26T00:00:00.000Z","owner":"AI governance lead (DEMO)","items":[{"clause":"4.3","title":"Scope of the AI management system","status":"partial","gap":"Scope statement not yet approved by the owner","action":"Owner signs the AIMS scope covering the inventory systems","owner":"Compliance","due_gate":"G2"},{"clause":"5.2","title":"AI policy","status":"gap","gap":"No published AI policy","action":"Publish AI policy in the trust centre","owner":"Compliance","due_gate":"G2"},{"clause":"6.1.2","title":"AI risk assessment","status":"partial","gap":"Risk register exists per system but without likelihood/impact scoring","action":"Score each inventory system; review quarterly","owner":"AI engineering","due_gate":"G3"},{"clause":"6.1.4","title":"AI system impact assessment","status":"gap","gap":"No impact assessment for branded agents and chat surfaces","action":"Impact assessment for systems that interact with natural persons","owner":"AI engineering","due_gate":"G3"},{"clause":"7.5","title":"Documented information","status":"met","gap":"","action":"AI-system inventory generated from the system and exported from the trust centre","owner":"Compliance","due_gate":"G2"},{"clause":"8.2","title":"AI risk treatment","status":"partial","gap":"Treatments exist (disclosure, marking, eval sets) but are not linked to risks","action":"Link controls to risks in the register","owner":"AI engineering","due_gate":"G3"},{"clause":"8.4","title":"AI system life cycle","status":"partial","gap":"Evaluation sets per task (LP-03-03) not yet complete for every task","action":"Eval set per model task; below-threshold fails CI (gate 6)","owner":"AI engineering","due_gate":"G2"},{"clause":"9.1","title":"Monitoring, measurement, analysis","status":"partial","gap":"Budget and usage visible per tenant; model quality drift not yet monitored","action":"Drift dashboards per task","owner":"AI engineering","due_gate":"G3"},{"clause":"A.6.2.8","title":"Event logs of AI systems","status":"met","gap":"","action":"ai.disclosure.recorded and per-agent-action audit with 5-year retention","owner":"Security","due_gate":"G2"},{"clause":"A.8.2","title":"Information for users (transparency)","status":"met","gap":"","action":"R11 disclosure text injected by runners; marking manifests on generated content","owner":"AI engineering","due_gate":"G2"},{"clause":"A.10.3","title":"Suppliers (model providers)","status":"gap","gap":"No model-provider contracts reviewed (no provider keys in the demo)","action":"Supplier review for each llm-gateway provider before G2","owner":"Compliance","due_gate":"G2"}],"summary":{"met":3,"partial":5,"gap":3}},"ai_inventory_problems":[]}}],"hard_rules":[{"id":"R1","rule":"No PAN, CVV or full payment credential enters any AGORA system, log or trace.","enforcement":"Payment fields are PSP token references only (`pm_demo_...`, `psp_ref`). Schemas in `protocols/` reject PAN-shaped strings. `server/src/modules/commerce/pan.ts` rejects them at the adapter. `scripts/scan-pan.mjs` runs in CI."},{"id":"R2","rule":"The merchant is always merchant of record; AGORA never confirms a payment.","enforcement":"No code path marks an order paid without a PSP confirmation reference. Checkout completion requires `psp_ref`."},{"id":"R3","rule":"Every inbound agent request passes trust-edge before any adapter or MCP tool.","enforcement":"Protocol routes are registered behind the trust-edge middleware (`server/src/protocols/trustEdge.ts`). Tests assert that direct calls are rejected."},{"id":"R4","rule":"Mandate, consent and disclosure records are append-only and hash-chained.","enforcement":"The evidence store has no update or delete path. `chain_hash = SHA-256(prev_hash, payload_hash, kind, verified_at)`. Verification is a real SHA-256 check (Trust page: \"Verify chain\")."},{"id":"R5","rule":"Lab agents declare identity, honour robots.txt and terms, never evade defences, and never purchase on third-party sites without test credentials and merchant consent.","enforcement":"The lab runner signs with Web Bot Auth (RFC 9421) and declares its user agent. Purchase actions require `consent_ref` (see `missions/`, `policies/trust-edge/default.cedar`)."},{"id":"R6","rule":"Generated assets cannot contain prohibited terms or unapproved claims.","enforcement":"A kernel-check gate runs in the content pipeline. Prohibited claims are listed per regulator in `packs/<id>/kernel.yaml`. Publish is blocked on failure."},{"id":"R7","rule":"Synthetic outputs are population-level only.","enforcement":"There is no per-persona output endpoint. The report generator refuses N below the threshold."},{"id":"R8","rule":"Tenant isolation everywhere.","enforcement":"`tenant_id` is on every record, event and key. Cross-tenant tests are in `server/test/`."},{"id":"R9","rule":"Earned-signal workflows log a disclosure for every outbound interaction and block fabricated reviews.","enforcement":"Playbook schema: `earned.*` steps need `disclosure_required: true`. Review ingestion requires a verified-order link."},{"id":"R10","rule":"Industry neutrality. No service, adapter, projector, runner, prompt, mart or console screen may assume an industry, an offering kind, a conversion type, a currency, a locale or a jurisdiction. Behaviour is parameterised by the tenant's packs; the generic pack (`packs/generic`) makes every module work for an unknown business.","enforcement":"`scripts/check-generality.mjs` (static scan: pack ids, offering-kind literals, currency/locale/jurisdiction codes outside `/packs`, `/policies`, `/missions`, fixtures and the pack loader), `scripts/copy-lint.mjs` (neutral vocabulary in shared UI and document templates), the industry fixture matrix (Anybiz LLC + six \"no pack\" businesses) and pack CI — the `generality` CI job. The conversion × kind matrix is data (`shared/src/generality.ts`); `—` cells return `not_applicable`."},{"id":"R11","rule":"AI disclosure. Every AGORA-operated agent that interacts with a person discloses that it is automated; generated content carries machine-readable AI-content marking.","enforcement":"Runners inject the declared UA and `AI_DISCLOSURE_TEXT` (`server/src/modules/compliance/api.ts`) and record `ai.disclosure.recorded`; the content pipeline cannot publish without a marking manifest; the AI-system inventory is served at `GET /v1/trust/ai-systems`."},{"id":"R12","rule":"Jurisdiction gating. Offerings in restricted categories are never surfaced, compared, routed or marketed to a user whose resolved jurisdiction is not permitted; unresolved jurisdiction denies.","enforcement":"`jurisdictionGate()` is evaluated in projectors, adapters, MCP tools, lab, visibility, lifecycle and ads; the \"UAE geo-fence\" test is a release blocker (`compliance` CI job). Flag `policy.jurisdiction.unresolved=deny` is immutable for restricted categories."},{"id":"R13","rule":"Self-serve by default. Every tenant/merchant operation available to AGORA staff is available to the tenant through console or API.","enforcement":"The API-only E2E test creates a tenant, merchant, connection, projections, lab plan, invoice preview and deletion through the public API; break-glass is read-only."},{"id":"R14","rule":"Budgeted intelligence. Every model call, lab run, visibility sample and study is attributed to a tenant and a task, counted against a budget with a hard stop, and visible in the console.","enforcement":"llm-gateway refuses calls without `tenant_id`/`task_id`; a breach raises `budget.exceeded` and halts the plan; billing meters reconcile to gateway usage within 1%."}]}