Trust by design
Riv is built so the sensitive parts stay safe: deterministic decisions, human approval where it matters, and an immutable ledger.
human-in-the-loop
Human in command when it matters
The engine handles routine on its own. When a policy says hold, the spend becomes pending: a human approves (counts toward the agent's limit) or rejects (denies) — in the Approvals tab, with authorship recorded.
- ✓ Deterministic decision: allow, block or require approval.
- ✓ Human approval with authorship recorded in the ledger.
- ✓ Phase 1 with no custody: only the credential hash.
Approvals · queue 1 pending
$12.00data-agent
snowflake · exceeds monthly cap
ApproveReject
immutable ledger
A ledger that never gets erased
Every decision — allowed, blocked or pending — lands in the ledger and stays. Soft-delete everywhere: history is immutable by design, ready for audit at any time.
agent · descriptionamount · status
pay-agentopenai api
$5.00 approved
research-botserp api
$8.00 blocked
ops-agenttwilio sms
$3.00 approved
data-agentsnowflake
$12.00 pending
pay-agentanthropic
$4.00 approved
phase 1
Phase 1 — pure software, no custody
Riv does not custody or move real money in Phase 1. We only store the credential hash. Real custody and settlement arrive in Phase 2, via a licensed partner.