Answer

Can a coding agent approve a deal or a discount on my behalf?

No. Commercial policy is deterministic code rather than a model's judgement — a renewal at or above the threshold stops and waits for a named human (C-03) — and a test asserts the refusal, so the boundary is a property of the system rather than a promise in a README (C-04). The same refusal holds where the money is: an agent actor calling quote.approve is rejected with status 403 and code HUMAN_APPROVAL_REQUIRED, and only a human user actor can decide (C-21). The scope is exactly this: the actor is asserted, not authenticated — there is no auth, tenancy or RBAC, and an actor header is not identity (L-01) — so it holds a boundary against an honest agent, not against an attacker with network access, and the threshold policy is proven on the built-in renewal object with a single value threshold.

What the ledger says, word for word

Each entry below is copied from site/claims.json, where it is bound to the evidence that holds it — a test file, a document, or a named repository fact — and to the limitation that travels with it. The answer above summarises these; these are the claim.

C-03

Commercial policy is deterministic code, not a model's judgement: a renewal at or above the threshold stops and waits for a named human.

LimitProven for the built-in renewal object and its single value threshold. A general policy engine over arbitrary custom objects does not exist.

JTBD-02tests/workflow.test.jstests/api.test.jsARCHITECTURE.mdDECISIONS.md

C-04

The agent cannot approve on the human's behalf. A test asserts the refusal, so the boundary is a property of the system rather than a promise in a README.

LimitThe actor is asserted, not authenticated: there is no auth, tenancy or RBAC, and an actor header is not identity. This holds a boundary against an honest agent, not against an attacker with network access.

JTBD-02tests/workflow.test.jsARCHITECTURE.md

C-21

The same refusal holds where the money is: an agent actor asking to approve a discounted quote is refused with a 403, and only a human user actor can decide.

LimitThe assertion lives inside a composite end-to-end test rather than a test named for it, so the citation is a file and a line rather than a test name. Extracting it into a named test is tracked in docs/strategy/GO_TO_MARKET.md; until then, cite the line.

JTBD-CO-03tests/commercial-e2e.test.jsdocs/COMMERCIAL_OPERATIONS.md

L-01 · No authentication, tenancy or RBAC.

The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network.

JTBD-15docs/PROJECT_STATUS.mdREADME.mdcrm app inspect reports productionPosture: local development only

Where this stops

Nothing on this page implies the framework is deployable. There is no authentication, tenancy or RBAC, so it is local-development-only whatever any single answer says. Every claim and every limitation is on one page, and the questions this project refuses to answer are published beside them.