Korsie
Book a demo
Architecture · XRPL testnet

How Korsie's agents run a school's money

Eight finance agents settle tuckshop sales, restock, follow up school fees and move money in from abroad on the XRP Ledger testnet. Each one acts on its own, inside limits a person signed, and every payment points back to the decision behind it.

  • Live on XRPL testnet
  • 8 finance agents
  • No token of our own
The system

Agents propose. Node chooses. Code checks. The ledger enforces.

OUTSIDE WORLDKORSIE PLATFORMTills and phonessigned taps, card, cashSchool's bankschool fee paymentsPeoplebursar, operator, parentsSuppliersx402 price quotesFamilies abroadand payment partnersSupabase (Postgres)tap inbox, wallets, feesmandates people signedsealed decision logrow-level security:the site can only readkorsie.co on Vercelread-only database keycontrols need a passwordinsert onlybank feedsign inlive reads,locked writesAGENT WORKER · FLY.IOThe agentsSettlement · Procurement · TreasuryAllowance · Swap · Fees · Belloptions, priced by codeNode, Korsie's AIpicks one option and says whya choice, not an amountPolicy enginechecks the mandate a person signedapproved and sealedSignerthe only part that holds agent keysre-checks everything, then dry-runsreads statedecision logx402: quote, then paid orderGuardian · its own processholds no keys; can pause any agentpause: the signer refusesXRP Ledger testnetwhere the hard limits liveAgent keys their owners can revokeOne all-or-nothing Batch per breakStock budget in a payment channelWeekly budget held in escrowAllowance by delegated paymentPayees verified by credentialPool open only to verified sendersConversion floor on the AMMRand rate from a price oracleSchool reserve needs two signaturesEach payment carries its decision hashRLUSD only from Ripple's issuer.No token of our own.signed txhash in memowatchesevery accountXRP or RLUSD, tagged with the learner's wallet code (no names on the ledger)visitors' browsers check the ledger themselves: decision seals, memos, and Try to break it
Code lists the options and works out every amount. Node, Korsie's AI, only chooses between them and says why. The policy engine checks the choice against the mandate a person signed. The signer checks it all again, then dry-runs the transaction with the ledger's simulate before it signs. The guardian runs apart from the agents and holds no keys, and anyone's browser can check the result on the ledger.
  • Node, the AI, choosing
  • Enforced on the XRP Ledger
  • What can stop an agent
  • Checks anyone can run
Limits

Where each limit is enforced

Most limits hold on the ledger itself, so a bug or a compromised agent can't get around them. Korsie's code adds the checks the ledger can't express, and the signer runs them again before every signature.

LimitEnforced byHow
An agent signs only with its own key, and its owner can take it awayXRP LedgerA regular key on each agent account; the person who owns the account keeps the master key
Restocking can't spend beyond the operator's budgetXRP LedgerA payment channel the tuckshop operator funds; claims beyond it are refused
Korsie's budget is released a week at a timeXRP LedgerA time-locked escrow; an early claim gets tecNO_PERMISSION
The allowance agent pays from a family only while the family allows itXRP LedgerPermission delegation the family can revoke with one tap
Only verified senders pay into the learners' poolXRP LedgerDeposit authorization with credentials issued by Korsie
A conversion never goes below its floorXRP LedgerA partial payment through the AMM with DeliverMin
The school reserve moves only with the bursar and the principalXRP LedgerA signer list with a quorum of two; the reserve's own key is disabled
Settlement pays everyone or no oneXRP LedgerOne Batch per break with tfAllOrNothing; every inner result is checked
Who may be paid, how much per payment and per period, and whenPolicy engine and signerThe mandate a person signed, read again before every signature
Agents pay only counterparties Korsie verifiedSigner, reading the ledgerA KorsiePayee credential from Korsie must be on the ledger
A paused agent can't actSignerPeople or the guardian pause it; the signer refuses everything it proposes
Proof

On the testnet ledger

A few of the agents' real transactions. Each carries its agent's SourceTag and the hash of the decision behind it.

  • A break settled as one Batch to four verified payees, signed with the settlement agent's own key8ECC9D33…
  • The procurement agent draws on the operator's stock budget channel with its own key876247D2…
  • A family abroad's school fee, paid to the school by delegated payment4A317357…
  • The treasury agent's owner revokes its key on the ledgerE68A646B…
  • Korsie withdraws a supplier's verification, so no agent can pay it54E65F36…
Stack

What runs where

SiteNext.js 16 on Vercel, holding only a read-only database key
DataSupabase Postgres with row-level security; no personal data on the ledger
AgentsOne worker on Fly.io, with the guardian in a separate process
Ledgerxrpl.js on the XRP Ledger testnet, with RLUSD from Ripple's issuer
Try to break itHow it worksBook a demo