Your domain

accounts-payable

The reusable operational contract this workspace runs on, its actions, lifecycle, the agents that propose against it, and the evidence it produces.

2 of 10 domains New domain
Submitted3420before executor ran
Allowed3310authorized
Blocked32withheld
Statusidlelast seen 13 days ago

Governance posture

The mode the runtime honors for this domain. Shadow records decisions as advisory, nothing is blocked or held. Enforce makes blocks and approval-holds binding. Flip deliberately; the change takes effect on the next decision.

Enforcing
Enforce · current

accounts-payable

Entity: Invoice · active · governing since Jun 15, 2026

Edit YAML Open Build Open evidence

Governance

How KIFF decides this domain, a projection of your code contract. The knobs below (allowed states, approval, risk) are what the runtime evaluates before an action runs. Your domain is executable software in your codebase, which is the record: edit the contract there, then re-activate. Enforcement posture (shadow / enforce) is operator-controlled, see Activity.

Governed actions

  • PAY_INVOICE high allowed in: approved approval: finance_manager
  • REQUEST_APPROVAL medium allowed in: received
  • REJECT_INVOICE medium allowed in: received, approved

Is what I'm governing real?

Each action reconciled against what the runtime has actually seen, where its side effect runs, and whether the gate has been exercised.

  • PAY_INVOICE Live
    Runs in the cloud runtime · 3 recent decisions · receipts recorded · last 13 days ago
  • REQUEST_APPROVAL Ready
    Runs in the cloud runtime · no recent decisions for this action
  • REJECT_INVOICE Ready
    Runs in the cloud runtime · no recent decisions for this action

KIFF attests the gate, the decisions it made and the receipts it recorded. For actions that run in your code, the side effect itself runs in your codebase, which is the record; its receipts here are evidence the gate was consulted, not proof of the side effect. Confirm the codebase side in your repo with kiff verify.

Lifecycle

States: received, approved, paid, rejected

  • received, approval_granted → approved
  • approved, payment_completed → paid

Agents

Connect an agent

Recently observed proposing identities, derived from real decisions, not a configured roster.

  • ap-payment-agent actor 2108 observed operations
  • invoice-review-service API key 1312 observed operations

Delete this domain

Removes accounts-payable and its configuration. Its recorded evidence (decisions, receipts) is kept as audit. This can't be undone.