How tomirahman/t3n-expense-guard works
ExpenseGuard is a narrowly scoped T3N confidential-computing expense-compliance agent. Its central workflow is agent invocation → contract policy evaluation (including FX and duplicate checks) → verdict and audit record → optional human approval and audit read-back. The graph preserves documented provisioning and delegation as supporting branches. Source excerpts are partial, so contract internals and several documented integrations are represented at the exact enclosing source paths, with only README-supported links.
Main entry points: invoke.ts ExpenseGuard agent · lib.rs Contract exports · deploy.ts Tenant provisioning · capabilities.rs Host capabilities
Components 17
Agent client
- ExpenseGuard agent
client/src/invoke.ts - Identity session
client/src/lib/session.ts - Tenant provisioning
client/src/deploy.ts - Delegation grant
client/src/grant.ts - Demo transcript
client/src/invoke.ts
TEE contract
- Contract exports
contract/src/lib.rs - Policy evaluation
contract/src/policy.rs - FX conversion
contract/src/fx.rs - Host capabilities
contract/src/capabilities.rs - Audit ledger
contract/src/ledger.rs - Tenant map names
contract/src/maps.rs
External systems
- Tenant state
- FX rate service
- Approver webhook
- T3N enclave host
Other components
- Employee claim
- Human approver
Connections 22
- Employee claim → ExpenseGuard agent: submits claim
- ExpenseGuard agent → Contract exports: invokes functions
- Contract exports → Policy evaluation: evaluates rules
- Policy evaluation → FX conversion: converts currency
- FX conversion → Host capabilities: requests egress
- Host capabilities → FX rate service: fetches rates
- Contract exports → Audit ledger: appends decision
- Audit ledger → Tenant state: writes audit map
- Contract exports → Tenant state: reads policy
- ExpenseGuard agent → Human approver: routes approval
- ExpenseGuard agent → Approver webhook: requests approval
- Host capabilities → Approver webhook: dispatches templated request
- Human approver → ExpenseGuard agent: returns sign-off
- ExpenseGuard agent → Demo transcript: records session
- Tenant provisioning → Identity session: authenticates tenant
- Tenant provisioning → T3N enclave host: registers contract
- Tenant provisioning → Tenant state: creates maps and seeds policy
- Delegation grant → Identity session: authenticates owner
- Delegation grant → T3N enclave host: delegates scope
- ExpenseGuard agent → Identity session: authenticates identity
- Contract exports → Tenant map names: selects tenant maps
- Tenant map names → Tenant state: names state maps