Skip to main content
Cardinal is building one protected lifecycle around the working products. This direction does not require rebuilding SafeSend, SafeReceive, Escrow, or the Customer Portal.
The products and API foundations exist at different MVP, pilot, testnet, and contract-implementation levels. A shared correlation ID, lifecycle ledger, and complete Portal view remain 30-day integration work.

​
Lifecycle requirements

1

Create the canonical intent

Create an immutable record of the exact transaction that Cardinal will evaluate.
2

Evaluate before value moves

Evaluate the exact intent before approval, signature, funding, acceptance, or settlement.
3

Record the decision

Store the request ID, policy version, matched rules, evidence source and freshness, and simulation mode.
4

Enforce the policy

Stop BLOCK decisions. Require the configured approval for REVIEW decisions.
5

Use the selected product

Let the approved policy route activity through the existing SafeSend, SafeReceive, direct, or Escrow flow. Higher-risk or higher-value transactions can require Protected Settlement.
6

Monitor pending settlement

Re-screen the relevant parties at approved intervals. A material new signal pauses settlement and creates a review task; it never silently releases or changes the policy record.
7

Correlate settlement

Bind transaction hashes and contract events to the original decision and display the outcome in the Portal and future Transaction Passport.

​
Escrow extensions

Keep the current buyer-and-seller and multisig Escrow implementations as the foundation. Bind compliance and counterparty approvals to escrow terms and the Cardinal security context before settlement. Treat milestone settlement and oracle conditions as longer-term work until a reviewed release confirms them.

Protected Settlement Engine

Review the risk-aware settlement architecture and its delivery gates.

​
Failure handling

Follow the approved fail-closed policy when intelligence, simulation, policy, or evidence storage is unavailable. Do not bypass controls, lose the correlation record, or default to ALLOW.