Control framework
Cryptographic Mandate Controls
A control class for machine-originated disbursements. When software proposes or initiates a payment, a Cryptographic Mandate Control produces durable, independently verifiable proof that an authorized human approved that specific payment.
This page defines the control class itself. It is written for controllers, internal audit, and audit partners, and it stands on its own whether or not you ever use Yebo. Yebo implements part of it today: a passkey approves a mission's limits and the gateway signs the receipt. Per-payment device signing is live and has been exercised in production: the approver's passkey signs the exact payment (amount, payee, agent, validity window), and anyone can check it offline with yebo-verify 0.2.0.
Definition
What a CMC is
A Cryptographic Mandate Control is a financial control with three properties that ordinary approval workflows do not have. This defines the control; where Yebo stands on each property today is under Where Yebo fits.
Approval sealed to the payment
The approver confirms on their own device, and the payment parameters (amount, payee, timestamp, policy version) are sealed into a signed mandate. Change any field and verification fails.
Device-bound identity
The approver completes the approval with a credential bound to their own device, such as a passkey, so a shared password or a forwarded email cannot stand in for them.
Independent verifiability
The resulting artifact can be verified years later using only the artifact and a public key. No access to the payment vendor's systems, no reliance on anyone's logs, no dependence on Yebo's servers.
Why now
Controls were built for human-speed workflows
Finance is moving toward machine-originated execution. AP automation already proposes payments; increasingly it initiates them. Existing disbursement controls are not broken, they are miscalibrated: they evidence that a workflow ran, not that a human approved a specific payment.
The evidence durability problem
Today the approval usually lives in an AP platform's logs, an email, or a Slack thread. When the auditor tests that control three years later, the vendor relationship may be gone, the logs may be unavailable, and the evidence collapses with them. A rail cannot certify itself.
The certification exposure
Under Sections 302 and 906, executives personally certify controls over every disbursement, including any that software initiates. A CMC gives the certifying officer a durable artifact behind that signature: proof of who approved exactly what, independent of any vendor.
Control language
Sample SOX control description
Draft language for a first-year SOX narrative. Adapt the threshold and scope to your environment with your auditor.
"Disbursements over $5,000 require a Cryptographic Mandate Control: an authorized approver confirms with a passkey on their own device, and the approved payment parameters (amount, payee, timestamp, policy version) are sealed into a signed mandate, independently verifiable without access to the payment vendor's systems."
Plain English: a human approves with a passkey on their own device, and what they approved is sealed into a signed record, so who approved exactly what can be checked years later without trusting anyone's logs.
Yebo today: the approver approves a mission with a passkey on the Yebo approval page. The passkey approves the mission's limits (capabilities, per-transaction limit, payees), every payment in the mission is checked against those limits, and the gateway signs the receipt. Per-payment device signing is live and has been exercised in production: the approver's passkey signs the exact payment (amount, payee, agent, validity window), and anyone can check it offline with yebo-verify 0.2.0. Execution runs in dry-run mode today, so no money moves. Review this with your auditor before adopting the language above.
Auditability
How an auditor would test a CMC
A CMC is designed to be tested with less effort than a conventional approval control, not more.
- 1
Select a sample of disbursements over threshold
Standard sampling from the disbursement population, exactly as with any approval control.
- 2
Obtain the mandate (Yebo Authorization Certificate) for each item
Each action the Yebo gateway executes carries a gateway-signed receipt (ECDSA P-256), with public keys published at the gateway's /authorization-receipt/keys endpoint. Execution runs in dry-run mode today, so these are dry-run receipts and no money moves. Vendor payouts through Stripe Connect are coming soon.
- 3
Verify the signature independently
Recompute the verification using the artifact and the published public key with the open-source npm verifier, npx yebo-verify@0.2.0. No access to the payment platform, the AP vendor, or Yebo is required.
- 4
Confirm the approver was authorized
Match the approver recorded with the mandate against the delegation of authority in effect at the payment date.
Implementation
Where Yebo fits
Yebo is one implementation of the CMC control class. It augments the AP platforms you already run; it does not replace them.
The Yebo Authorization Certificate
Each action the Yebo gateway executes (dry run today) produces a YAC: a receipt signed by the gateway key (ECDSA P-256), exportable as an audit artifact and verifiable offline with the published public key using the open-source npm verifier, npx yebo-verify@0.2.0. Execution runs in dry-run mode today, so no money moves. For missions, the approver's passkey approves the mission's limits and every payment is checked against them. Per-payment device signing is live and has been exercised in production: the approver's passkey signs the exact payment (amount, payee, agent, validity window), and anyone can check it offline with yebo-verify 0.2.0. AI can propose. With device approval required, it cannot approve itself.
Fail-closed by design
For actions routed through the Yebo gateway, no decision means no execution: if the policy engine cannot be reached or does not allow the action, the request is denied. Yebo cannot see payments that do not pass through the gateway.
Scope
Scope of current validation
The control class is general. The validation is deliberately not.
Current validation scope: AI-initiated vendor disbursements. Yebo is validating the CMC framework against this control scenario first, with practitioner review in progress. The framework above is written to stand on its own; claims about additional control scenarios will follow the same pattern, validated with practitioners before they are made.
Honesty about scope builds more trust with auditors than breadth does. If you want to test the current scenario yourself, the verification page has a signed sample mandate and the verifier. No account required.
The framework is being shaped by practitioners
We are developing the full CMC framework with input from finance leaders and audit partners before publication: the threat model for machine-originated disbursements, mandate artifact requirements, testing procedures, and control language variants. If you are a controller writing a first-year SOX narrative or an audit partner covering one, we want your review.