Overview

The mental model in five minutes.

This page is optional for headless integrations.

RobotMoney is one API for governing agent-initiated financial actions. Underneath, it does four things, in this order, every time:

Remember   →   Decide   →   Execute   →   Prove

Word	What RobotMoney does	What you call it
Remember	Pulls in evidence from banks, ERPs, processors, on-chain wallets, and structures it into a queryable record	Ledger and Wiki reads
Decide	Evaluates each proposed action against tenant policy and headless limits	authorization decisions
Execute	Dispatches approved actions through the right rail when the integration uses execution	PaymentIntents and rails
Prove	Records every step in a tamper-evident log anchored on Base L2	Audit and Proof APIs

Everything else in this documentation is depth on those four steps.

Why This Matters

Most fintech infrastructure stops at execution. The provider moves the money and confirms it landed. That leaves the integrating application to handle context, rules, and audit on its own. RobotMoney is built around the fact that agents need governed decisions before any money path can be trusted.

Without remember	Without decide	Without execute	Without prove
Agent acts on partial data	Agent acts outside policy	Agent can't move money	Agent's actions can't be verified

The Four Ideas in Detail

🧠 Memory

What RobotMoney knows about a tenant, where it came from, and how to query it.

Memory

🛡 Policy

The rules a tenant signed. How decisions are made.

Policy

🤖 Agents

Who can read, propose, and act. Internal and external.

Agents

📜 Proof

Why every claim RobotMoney makes is verifiable.

Proof

Tenants

Everything in RobotMoney happens for a tenant. A tenant is a customer of yours: a business, a workspace, a user. RobotMoney isolates tenants at the storage, key, and policy layer.

await brain.authorizations.create({
  execution: "external",
  amount: "125.00",
  currency: "USD",
  destination_counterparty_id: "cp_acme_legal",
});

await brain.audit.list({ limit: 20 });

Cross-tenant access is impossible by construction. You'll never see one tenant's data accidentally surface in another tenant's response.

Provenance

Every fact RobotMoney returns carries citations.

const answer = await brain.wiki.question({
  question: "What did we spend on AWS last month?",
});

answer.text; // a natural-language answer
answer.citations; // pointers back to the specific transactions, invoices, or evidence that produced the answer

You never have to take RobotMoney's word for anything. Every claim links back to source evidence.

Idempotency

Every mutating call accepts (and most require) an idempotency key.

await brain.authorizations.create(
  {
    execution: "external",
    amount: "125.00",
    currency: "USD",
    destination_counterparty_id: "cp_acme_legal",
    invoice_id: "inv_8231",
  },
  { idempotencyKey: "auth_inv_8231_2025_09" },
);

Retries with the same key return the existing action, so a network blip never produces a duplicate payment.

Where the Depth Lives

When you're ready, the protocol underneath has more to offer. Each of those concepts maps to a specific layer.

Concept	Layer (deep dive)
Memory	Raw, Ledger, and Wiki
Policy	Policy and the pre-execution gate
Agents	The Agent layer
Proof	Audit and on-chain anchoring

You can build with RobotMoney without reading any of those sections. They are there when you want the deeper view.