Change one field. The gate holds the wire.
Pick an attack on a $480,000 wire. Every check runs before the money moves.
Released
Every field matches what the CFO signed.
Sent to the payment hub.
Order the portal sentas submitted
Tap a value to tamper with it yourself.
What the CFO signedpasskey, 9:41
Receipt: Ed25519, kid manav-2026-10, signed 9:41:07
What the gate compared
| Check | Order | Signed | Result |
|---|
Limit: an approver who is fooled into approving the wrong payee still signs it. The phone shows the full payee before the tap. If you keep callback-only release, a cloned voice can still pass the desk. Threat model and limits
Run this against your own wire flow.
20 minutes with an engineer. Then a 30-day shadow pilot beside your desk.