First AI-Assisted Transfer Approval
with Replayable Delegation.

01The delegation chain (reconstructed from signed events)

The AI's granted_by field names the human principal directly. The replay engine's trace_provenance function walks: AI grant → find parent grant whose granted_to == princ_customer_9 → walks her root-grant → terminates at root. The delegation chain exists in the canonical event log.

02The reconstructed state_id

03The governance assertion (the spine of the proof)

The proof's spine is the negative assertion: the AI's reconstructed scope does NOT contain approve_transfer. The test asserts this directly with a hard failure message — "GOVERNANCE FAILURE: AI scope contains approve_transfer — AI was authorized only to review, not approve."

04The forensic explanations

{
  "authority_id": "auth_44962d9b-…_ai_transfer_review",
  "included": true,
  "reason": "Granted by princ_customer_9 to princ_ai_transfer_reviewer_001;
             policy pol_ai_transfer_advisory_review_v1;
             chain to root verified."
}

The phrase "chain to root verified" in the AI's explanation is the replay engine confirming that princ_customer_9's grant exists, is unrevoked, and is itself rooted. That's the forensic signal a regulator looks for.

05The five reconstructable facts (the regulator's checklist)

06The receipt narrative (template for a live AI-assisted approval)

{
  "decision_class": "approved | denied | escalated",
  "recommender": "princ_ai_transfer_reviewer_001",
  "recommender_authority": "auth_44962d9b-…_ai_transfer_review",
  "recommender_policy": "pol_ai_transfer_advisory_review_v1",
  "recommendation_class": "CONDITIONAL",
  "recommendation_text": "<the AI's natural-language recommendation>",
  "final_approver": "princ_customer_9",
  "final_approver_authority": "auth_44962d9b-…_transfer_approval",
  "final_approver_policy": "pol_transfer_approval_v1"
}

Two principals named. Two authority IDs named. Two policies named. Three years later, replay reconstructs all of it.

07Known limitations

1. Reconstruction-only, not live receipt. No transfer-approval receipt has been issued against a live endpoint with this tenant. Live issuance requires Bearer minting for both principals.
2. Structural AI principal, not a deployed model. The AI is a principal in the canonical event log; the model / agent runtime it represents is out of scope.
3. Single delegation level, not the full ladder. This is L1. L2 (Authority Envelope), L3 (Supervisor), L4 (Autonomous Operations) are subsequent proofs.
4. Scope-subset enforcement is policy-layer, not chain-layer. The engine validates chain provenance; policy-correctness lives in pol_* definitions.
5. AuthEvent.signature not verified at replay ingestion (Phase E lock; same as all current proofs).

08Where this proof sits in the agentic management ladder

09Evidence appendix

10Readiness determination

What this unlocks: conversations with Ondo, Securitize, Kinexys, transfer agents, fund administrators, and regulators about constrained AI participation in regulated workflows. The answer is the delegation chain — visible in the canonical event log, replayable forever, with the AI's scope provably review-only.

What this does not unlock: a claim that any tokenization platform has deployed an AI reviewer; a claim that the chain handles multi-agent supervision (L3) or autonomous-operation envelopes (L4); a claim that scope-subset enforcement is engine-layer.