WarrantIndia has built trust infrastructure as a public good once. Agents need the next layer.
Identity, consent and payments already run on open, interoperable rails with private ledgers underneath. When agents start deciding inside that system, the missing piece is a shared way to say what an agent decided and on what evidence, without pooling anyone's data.
Built by AI Foundry Ventures in Bengaluru · open specification, CC BY 4.0 · open-source reference implementation, Apache 2.0
The pattern is already here
Each layer of India Stack has an agent equivalent.
| India Stack | What it did | For agents |
|---|---|---|
| Aadhaar | Verifiable identity at population scale | Agent identity, bound to the legal principal it acts for |
| Account Aggregator and DEPA | Consent-based data sharing | Mandates: signed, scoped, revocable delegation |
| UPI | Interoperable rails over private ledgers | Commitments: the decision record as the interoperable trust format |
| DigiLocker | Verifiable documents | Evidence, referenced by digest rather than copied |
The principle carries over unchanged: share proofs, not data. A record carries digests of what an agent read and a signature, never the customer file.
In-country by default
The decision can be made inside the bank, too.
A record is only half the residency question. The other half is where the model that made the decision ran. Warrant records that on every decision, as evidence, and a decision class can refuse to send data to a region it does not allow.
Warrant's decision-model interface is vendor-neutral. The first adapter, for TypeSafe's Jev, calls a hosted service that its operator states is hosted in the United States. An adapter for Laya, an open-weight decision model published under Apache 2.0 by an Indian company, runs entirely inside your own environment; it shipped in Warrant 0.7.0.
A model that runs locally still has to earn trust on your own data. Out of the box its answers need fine-tuning and recalibration on your past decisions, which is exactly what measuring stated confidence against realised outcomes is for.
On every recordWhich model answered, which version, and the endpoint and region it ran in. A region Warrant cannot positively identify is recorded as unknown, never guessed.
The direction of payments
“AI may recommend, but authentication and final settlement must follow deterministic auditable rules.”
That is how NPCI's non-executive chairman, Ajay Kumar Choudhary, described the architecture for agent payments at the Global Fintech Fest on 10 September 2026, separating intent, authorisation and settlement.
It is the same split an Agent Decision Record makes between an agent's proposal and the evidence that authorises it. What the payment system has called for but not defined is the record of what an agent decided and why.
Source: MediaNama, September 2026. This is press coverage of public remarks, not a circular. No binding rules or limits have been published, so treat it as direction, not requirement.
| Primitive | Payment system | What follows |
|---|---|---|
| Identity | An agent registry, reported in press coverage | For payment agents, a record should reference that registry's identity rather than invent another |
| Mandate | Delegation and limits for agents, reported as under development | A payment mandate becomes one kind of evidence on a record |
| Settlement | UPI | The check runs before a payment is initiated; UPI itself does not change |
| Commitment | Called for as auditable rules; no record format published | The gap an open decision record format fills |
Data protection
An audit trail that survives an erasure request.
Record-keeping duties say keep it. Data protection says delete it on request. A decision record can satisfy both, if the personal data was never on the record in the first place.
Sensitive evidence is held as a salted digest: a hash of a random salt and the content. The salt and any captured content live in a sidecar next to the store. Delete the sidecar entry and the personal data is gone, the digest can no longer be linked to any value, and the signed record still verifies.
Why the salt matters
A plain hash of a low-variety value, such as a sanctions result with no hits or a turnover band, can be reversed by hashing every possible value and comparing. A random salt per item makes that impossible without the sidecar.
Shipped in Warrant 0.7.0. Whether this meets a specific obligation under the Digital Personal Data Protection Act is for your counsel; we do not give that opinion.
The two-week test
One real workflow. Fourteen days. A finding on day one.
We start with what your agents have already done, not with a new integration. The fee is credited in full against your first year.
- Day 1Import the traces you already have, check every past decision against your written policy, and hand you the first finding.
- Days 2 to 5Instrument one live agent workflow inside your environment. Nothing leaves your systems.
- Days 6 to 12Record real decisions. Your risk team runs one review cycle on escalations, flagged decisions and a random sample.
- Days 13 and 14A written finding, a replay walkthrough for your engineers, and an export your auditor can verify offline.
Book the test
Leave a work email. One reply, from a person, within two working days.