ChainIT Answered Who Authorized the AI Agent. Now It Answers: Do Current Compliance Evidence and Policy Permit It to Act?

Agentic commerce does not eliminate compliance requirements; it heightens the need for current, transaction-specific controls as AI agents increase the speed, scale and autonomy of transactions

SCOTTSDALE, Ariz., Sept. 8, 2026 /PRNewswire/ -- Last week, ChainIT published "Provable Authority" to address a fundamental question for the emerging agentic economy: Who authorized the AI agent, within what limits and for which exact action? Today, ChainIT, a digital verification and compliance platform, announced the release of "Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific Decisioning," a companion technical white paper describing the ChainIT Compliance Protocol within the ChainIT Transaction Truth Architecture. It addresses the next operational question: Even when valid authority exists, do current compliance evidence and the organization's applicable policy permit this specific action to proceed now—whether it is initiated by an AI agent, an authorized person, a group, an organization or an organization-controlled workflow?

Agentic commerce does not eliminate compliance requirements; it compresses the time available to evaluate them as AI agents operate continuously and at machine speed. Financial institutions and businesses already maintain customer due diligence, sanctions screening, transaction monitoring, licensing, beneficial ownership and other compliance programs. The challenge is that identity, authority, compliance evidence, policy, review and payment approval often remain fragmented across separate systems. A prior check may not show which source and policy were current, what decision was reached or whether that decision was bound to the exact action that followed.

An AI agent may be properly authorized to pay an approved vendor and still need to be stopped from completing a particular transaction. A sanctions or ownership record may have changed, the destination may be new, a license may no longer satisfy policy, or an institution-generated alert may require review. Provable Compliance is designed to evaluate what applies at the moment of reliance without turning one favorable check into a permanent, reusable compliance badge.

Provable Compliance is designed to make the resulting decision attributable, time-bounded and transaction-specific. The architecture uses modular Evidence Assertion VDTs—Validated Data Tokens—to preserve source class, provenance, observation time, confidence, permitted purpose and privacy classification. A versioned Compliance Policy Profile selects the applicable requirements. The ChainIT Business Rules Engine returns explicit, reason-coded predicates, and the organization-configured ChainIT Workflow Engine produces a signed Compliance Decision VDT with a disposition such as Allow, Allow with Controls, Step-Up, Review, Hold, Reject, Prohibit or Stale/Unknown.

"Last week, we addressed who authorized the AI agent and what the agent was permitted to do. Provable Compliance addresses the next question: even when authority exists, do current compliance evidence and the organization's policy permit this specific action right now?" said Jeremy Blackburn, Chief Executive Officer of ChainIT. "Agentic commerce does not eliminate compliance requirements; it compresses the time available to evaluate them. AI agents should not operate from a check performed weeks or months earlier, and a favorable result should never become standing authority to move money. Before an agent—or any authorized person or workflow—takes a consequential action, organizations need a current, attributable and auditable decision. That is the problem Provable Compliance is designed to solve."

Together, the two white papers define the ChainIT Authority Protocol and ChainIT Compliance Protocol as constituent controls within ChainIT Transaction Truth, the company's zero-trust transaction control, execution and evidence architecture. Identity establishes who is present; Authority determines who or what may act and within what bounds; and Compliance determines whether current compliance evidence and policy permit the action now. Before value may move, the control path must still verify scope, approvals, freshness, capacity, exact instruction binding and a single-use execution credential. The resulting Transaction Truth is a source-attributed, time-bounded, purpose-specific and independently verifiable record of the parties, authority, evidence, policy, transaction terms, execution, settlement, reconciliation and outcome.

Core Technical Pillars

• Source-attributed, time-bounded evidence: Separate Evidence Assertion VDTs preserve the source class, source version, observation time, confidence, purpose and privacy treatment for each relevant fact or institution-generated state.
• Versioned policy and deterministic decisioning: A Compliance Policy Profile selects the requirements for the institution, product, role, counterparty, jurisdiction, rail and reliance event; the BRE returns explicit predicates and the organization's Workflow Engine determines the disposition.
• Runtime re-evaluation and scoped enforcement: Evidence freshness is evaluated at the moment of reliance, with live or event-driven refresh where required. A material change affects only the dependent subject, activity, product, counterparty, jurisdiction or transaction unless law or policy requires broader blocking.
• Compliance-to-authority execution controls: A final Allow in a Compliance Decision VDT is one input to the ChainIT Authority Protocol—not payment authority. The final protocol must still verify identity, ARP authority, scope, approvals, capacity, the exact transaction digest and a valid single-use execution credential before value moves.
• Controlled disclosure and append-only evidence: Subjects, institutions, payment or technology partners, and regulators receive only the information appropriate to their role, while append-only lifecycle VDTs and Valitorum preserve what evidence was relied upon, what decision was made and what occurred.

"Compliance is not a permanent badge that follows a person, business or AI agent everywhere," said Russell Lessard, Chief Compliance Officer of ChainIT. "Sanctions, AML monitoring, PEP risk, identity assurance, licensing, beneficial ownership and payment-transparency requirements all operate differently. A proposed action may be allowed, allowed with controls, held for review or prohibited depending on the current compliance evidence, jurisdiction and policy. Provable Compliance preserves those distinctions and records the decision while disclosing only what each recipient is authorized to receive."

The framework is intended for financial institutions, payment companies, stablecoin issuers, marketplaces, technology providers and enterprises evaluating activity initiated by people, groups, organizations, organization-controlled workflows and AI agents. It does not replace a regulated institution's AML/CFT, sanctions or other compliance program and does not create a universal legal determination. Instead, it provides an evidence-and-decision layer that can be integrated with existing institutional policies, review processes and execution controls.

Financial institutions, payment companies, stablecoin issuers, technology companies, developers, compliance leaders and enterprise organizations can download "Provable Compliance" at https://chainit.com/chainit-provable-compliance-white-paper/. Last week's "Provable Authority" white paper is available at https://chainit.com/chainit_provable_authority_whitepaper/.

About ChainIT

ChainIT provides digital identity, business verification, authority, compliance evidence, payments and auditable workflow solutions that help organizations make business relationships and transactions commercially verifiable. ChainIT's platform supports KYB, KYC, identity verification, authority validation, beneficial ownership workflows, sanctions and watchlist screening, compliance documentation, ongoing monitoring, and immutable audit evidence through Validated Data Tokens (VDTs).

By helping organizations verify people, businesses, authority, compliance evidence and transaction outcomes through source-attributed evidence, automated workflows and immutable records, ChainIT enables customers to reduce risk, streamline onboarding, improve transparency and make critical operational decisions based on verified and current information.

SOURCE ChainIT Inc