Rein System architecture. Spend control and a tamper-evident audit trail for AI agents, on Amazon Aurora DSQL.
Actor
AI agent (procurement, plus the demo driver)
Holds Ed25519 keypairs for the principal, the vendor, and the agent. Builds and signs the AP2 mandate bundle for each purchase. Private keys never leave the server.
Intent, signed by the principal Cart, signed by the vendor Payment, signed by the agent
signed purchase request, over HTTPS / TLS
Frontend, on Vercel
Browser, Next.js App Router
Client components poll the read APIs every few seconds, so spend and the activity feed update on their own. State lives in React. No browser storage, so the app layer is stateless and scales horizontally.
Overview Budgets Activity Audit Demo
fetch and POST as JSON, money as strings (BigInt cents)
Control plane
Next.js route handlers, Node.js runtime, Vercel functions
All database access runs on the Node.js runtime, never the Edge runtime, because a Postgres connection needs raw TCP. Every endpoint validates its input.
Read APIs
GET /api/overview
GET /api/spend
GET /api/agents
GET /api/transactions
GET /api/transactions/[id]/audit
GET /api/health
Write and actions
POST /api/budgets
POST /api/demo/run
POST /api/demo/reset
Purchase engine, one transaction, OCC retry
1 Verify the mandate chain Ed25519 over canonical JSON: signatures, hash links, intent scope
2 Kill-switch, the agent must be active
3 Read the applicable budgets and every ancestor cap
4 Budget check, does the amount fit every cap
5 Claim the payment as single use (redeemed_payments key)
6 Decrement remaining_cents the single row two racing purchases collide on
7 Write the transaction, two balanced ledger rows, the chain
8 COMMIT
on SQLSTATE 40001: roll back, re-read the balance, re-run
Any gate fails, the purchase is blocked and recorded with its reason.
connect with an IAM token per connection, over TLS
Data layer, primary backend
Amazon Aurora DSQL
Optimistic concurrency with serializable isolation, strong consistency, and it scales to zero between bursts. No foreign keys, so referential integrity is enforced in the application. Money is integer cents in BIGINT.
agents
principals that spend, with a status the kill-switch reads
budgets
remaining_cents, the concurrency control point
mandates
the signed intent, cart, payment chain
transactions
one row per decision, with the reason
ledger_entries
two balanced rows per approved purchase
redeemed_payments
payment hash as the key, single use
Security and compliance
Authentication
IAM SigV4 token minted per connection. No database password is ever stored. TLS is required.
Authorization, verified before any write
Three Ed25519 signatures, the principal, the vendor, and the agent, checked on the server before money moves.
Scope enforcement
The intent limits the amount, the categories, the vendors, and the expiry. Out of scope is blocked.
Tamper evidence
A content-hash chain, payment equals hash of intent plus cart. Changing any field breaks the chain.
Replay protection
A payment is single use. A second redemption collides on the primary key and is recorded as a replay.
Least privilege
The IAM identity grants only dsql:DbConnectAdmin, scoped to one cluster.
Secrets management
Credentials live only in environment variables, never in the repository. The env file is gitignored.
Immutable audit, compliance ready
Every decision is recorded with its reason. The double-entry ledger and the signed chain make the trail complete, ordered, and tamper evident.
Containment
An instant kill-switch revokes an agent, and it is stopped on its very next decision, with no propagation window.
Data safety and isolation
Money is integer cents in BIGINT, never a float. Database access is pinned to the Node.js runtime, not the Edge.
Layers, top to bottom: agent, browser, control plane, ledger green the concurrency control point and the no-overspend guarantee blue the request path and authorization violet integrity and replay amber the optimistic-concurrency retry