# Agent payment workers

Workers that run your payments back office, under your rules.

Workers are agents that run the payments back office. Each one works under your rules and inside a mandate you set. Each action lands in the record with the rule behind it. They propose, you approve what matters, and nothing they do is hidden.

1. **Rule**: You write it. Workers can't change it.
2. **Mandate**: What a worker may do, for whom, up to what limit.
3. **Record**: Every action, its reason and its result, in the ledger.

## Rail worker

Applies your rules to every payment and writes the decision to its ticket, cited to the rule that chose the rail.

- **Allowed to**: Choose among the rails your rules allow. It can't add a rail or change a rule.
- **Writes to the record**: A decision on each ticket, linked to the ledger line.

## Reconciliation worker

Matches every settlement, payout and fee line back to its source transaction, across cards, bank rails and stablecoins.

- **Allowed to**: Match and flag. It can't move money.
- **Writes to the record**: A match record per row. Breaks go to the exception queue with the evidence attached.

## Payout worker

Builds each payout run from your schedule, shows which items make the next cutoff, and sends them on the rail each payee chose.

- **Allowed to**: Release payouts inside your schedule and limits. Larger runs wait for your approval.
- **Writes to the record**: The run, each payout, its rail, its fees and its cutoff.

## Dispute worker

Gathers evidence for each dispute from the record, drafts the response and tracks every deadline.

- **Allowed to**: Draft and file inside the rules you set. You approve anything above your threshold.
- **Writes to the record**: The evidence pack, what was filed, when and the outcome.

## Mandate worker

Checks every agent request against what that agent may do, through the same access check the API runs. Each request is allowed or denied, and the decision is recorded before any response goes out. It quotes the payment before anything reaches a network.

- **Allowed to**: Allow or deny. It can't widen what an agent may do: that change is proposed, and a person approves it.
- **Writes to the record**: The request, the access decision (allowed or denied) and its decision ID.

## Fee worker

Checks every fee line against your contracted rates and flags anything that doesn't match.

- **Allowed to**: Flag and report. It can't change a rate.
- **Writes to the record**: A fee check per movement, plus a monthly variance report.

## You stay in control

- Every worker runs under a mandate you can read, change and revoke.
- Actions above your thresholds wait for a person.
- Every action has a reason, a rule version and an undo path.
- Every access decision, allowed or denied, is recorded before any response goes out.
- Widening what an agent may do is a proposed change. A person approves it, and the approval is bound to that change.
- Your own agents use the same API, the same mandates and the same record.

_The rail, reconciliation, payout, dispute and fee workers run on the designed payment endpoints in the API reference. The mandate worker's decisions run through the API's access check._

- [Mandates and the decision trace](/docs/concepts/): How rules, mandates and the record fit together.
- [MCP tools](/docs/mcp/): Run or supervise workers from any MCP client.

Request access: sales@insimbi.net

_insimbi is in early access with design partners._