# tomirahman/t3n-expense-guard architecture

> Architecture diagram of the GitHub repository tomirahman/t3n-expense-guard, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tomirahman/t3n-expense-guard
- Repository: https://github.com/tomirahman/t3n-expense-guard

## Overview

ExpenseGuard is a narrowly scoped T3N confidential-computing expense-compliance agent. Its central workflow is agent invocation → contract policy evaluation (including FX and duplicate checks) → verdict and audit record → optional human approval and audit read-back. The graph preserves documented provisioning and delegation as supporting branches. Source excerpts are partial, so contract internals and several documented integrations are represented at the exact enclosing source paths, with only README-supported links.

Main entry points: [`client/src/invoke.ts`](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/invoke.ts) (ExpenseGuard agent), [`contract/src/lib.rs`](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/lib.rs) (Contract exports), [`client/src/deploy.ts`](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/deploy.ts) (Tenant provisioning), [`contract/src/capabilities.rs`](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/capabilities.rs) (Host capabilities)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Agent client"]
  node_agent["ExpenseGuard agent<br/>[invoke.ts]"]
  node_session["Identity session<br/>[session.ts]"]
  node_provision["Tenant provisioning<br/>[deploy.ts]"]
  node_grant["Delegation grant<br/>[grant.ts]"]
  node_transcript["Demo transcript<br/>[invoke.ts]"]
end

subgraph group_contract["TEE contract"]
  node_contract["Contract exports<br/>[lib.rs]"]
  node_policy["Policy evaluation<br/>[policy.rs]"]
  node_fx["FX conversion<br/>[fx.rs]"]
  node_capabilities["Host capabilities<br/>[capabilities.rs]"]
  node_ledger["Audit ledger<br/>[ledger.rs]"]
  node_maps["Tenant map names<br/>[maps.rs]"]
end

subgraph group_integrations["External systems"]
  node_tenant[("Tenant state")]
  node_fxservice["FX rate service"]
  node_webhook["Approver webhook"]
  node_host["T3N enclave host"]
end

node_employee(("Employee claim"))
node_approver(("Human approver"))

node_employee -->|"submits claim"| node_agent
node_agent -->|"invokes functions"| node_contract
node_contract -->|"evaluates rules"| node_policy
node_policy -->|"converts currency"| node_fx
node_fx -->|"requests egress"| node_capabilities
node_capabilities -.->|"fetches rates"| node_fxservice
node_contract -->|"appends decision"| node_ledger
node_ledger -->|"writes audit map"| node_tenant
node_contract -->|"reads policy"| node_tenant
node_agent -->|"routes approval"| node_approver
node_agent -.->|"requests approval"| node_webhook
node_capabilities -.->|"dispatches templated request"| node_webhook
node_approver -->|"returns sign-off"| node_agent
node_agent -->|"records session"| node_transcript
node_provision -->|"authenticates tenant"| node_session
node_provision -->|"registers contract"| node_host
node_provision -->|"creates maps and seeds policy"| node_tenant
node_grant -->|"authenticates owner"| node_session
node_grant -->|"delegates scope"| node_host
node_agent -->|"authenticates identity"| node_session
node_contract -->|"selects tenant maps"| node_maps
node_maps -->|"names state maps"| node_tenant

click node_agent "https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/invoke.ts"
click node_session "https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/lib/session.ts"
click node_provision "https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/deploy.ts"
click node_grant "https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/grant.ts"
click node_contract "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/lib.rs"
click node_policy "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/policy.rs"
click node_fx "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/fx.rs"
click node_capabilities "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/capabilities.rs"
click node_ledger "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/ledger.rs"
click node_maps "https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/maps.rs"
click node_transcript "https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/invoke.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_agent,node_session,node_provision,node_grant,node_transcript toneBlue
class node_contract,node_policy,node_fx,node_capabilities,node_ledger,node_maps toneAmber
class node_tenant,node_fxservice,node_webhook,node_host toneMint
class node_employee,node_approver toneIndigo
```

## Components

### Agent client

- [ExpenseGuard agent](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/invoke.ts): `client/src/invoke.ts`
- [Identity session](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/lib/session.ts): `client/src/lib/session.ts`
- [Tenant provisioning](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/deploy.ts): `client/src/deploy.ts`
- [Delegation grant](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/grant.ts): `client/src/grant.ts`
- [Demo transcript](https://github.com/tomirahman/t3n-expense-guard/blob/main/client/src/invoke.ts): `client/src/invoke.ts`

### TEE contract

- [Contract exports](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/lib.rs): `contract/src/lib.rs`
- [Policy evaluation](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/policy.rs): `contract/src/policy.rs`
- [FX conversion](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/fx.rs): `contract/src/fx.rs`
- [Host capabilities](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/capabilities.rs): `contract/src/capabilities.rs`
- [Audit ledger](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/ledger.rs): `contract/src/ledger.rs`
- [Tenant map names](https://github.com/tomirahman/t3n-expense-guard/blob/main/contract/src/maps.rs): `contract/src/maps.rs`

### External systems

- **Tenant state**
- **FX rate service**
- **Approver webhook**
- **T3N enclave host**

### Other components

- **Employee claim**
- **Human approver**

## Connections

- Employee claim → ExpenseGuard agent: submits claim
- ExpenseGuard agent → Contract exports: invokes functions
- Contract exports → Policy evaluation: evaluates rules
- Policy evaluation → FX conversion: converts currency
- FX conversion → Host capabilities: requests egress
- Host capabilities → FX rate service: fetches rates
- Contract exports → Audit ledger: appends decision
- Audit ledger → Tenant state: writes audit map
- Contract exports → Tenant state: reads policy
- ExpenseGuard agent → Human approver: routes approval
- ExpenseGuard agent → Approver webhook: requests approval
- Host capabilities → Approver webhook: dispatches templated request
- Human approver → ExpenseGuard agent: returns sign-off
- ExpenseGuard agent → Demo transcript: records session
- Tenant provisioning → Identity session: authenticates tenant
- Tenant provisioning → T3N enclave host: registers contract
- Tenant provisioning → Tenant state: creates maps and seeds policy
- Delegation grant → Identity session: authenticates owner
- Delegation grant → T3N enclave host: delegates scope
- ExpenseGuard agent → Identity session: authenticates identity
- Contract exports → Tenant map names: selects tenant maps
- Tenant map names → Tenant state: names state maps