Paperclip explained: an operating layer for teams of AI agents
Paperclip source tour: approval and budget decisions
Read two services before trusting the governance labels in the UI.
What you will learn
- Approval has state transitions
- Budget observation is scoped
- Trace one decision end to end
Before you start
- Node.js and agent runtime basics
- A test company with non-sensitive tasks
Turn the source review into a bounded experiment with stop conditions.
Key takeaways
- Approval is a state transition with an actor.
- Budget scope and time window affect the result.
- Source inspection is narrower than an end-to-end security audit.
Approval has state transitions
The inspected approvals service resolves a request only from pending or revision-requested states. An approved built-in agent can then be reconciled with the stored configuration. Read the transaction path and error cases when adapting this to a real board.
A reviewer identity and decision note matter as much as the status value. Test rejection and a repeated approval request in a local instance to see which event is retained.
Budget observation is scoped
The budgets service computes observed spend against a policy window and returns warning or hard-stop states. It contains paths to pause scopes and cancel queued work after a hard stop.
That source path supports the existence of enforcement logic; it does not prove every external provider invoice is complete or timely. Compare recorded cost events with provider billing before relying on the cap as an accounting guarantee.
Trace one decision end to end
Start at the API request, inspect the service function and database update, then check the audit event. Preserve the company and actor IDs in the test. Avoid changing service code based on the UI label alone.
We inspected these two service files at a fixed commit. Other routes, adapters and authentication middleware were not exhaustively audited.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Locate resolveApproval and its allowed source states.
- 2
Locate budgetStatusFromObserved and hard-stop handling.
- 3
Design a test for repeated approval and late cost events.
Copy-ready example
// Source-reading map, not executable application code
resolveApproval(id, actor, decision)
budgetStatusFromObserved(spend, amount, warningPercent)Frequently asked questions
Does a hard stop guarantee zero overspend?
No. Check cost-event timing and provider billing against the budget policy.
Can any board member approve?
Verify the route authorization and membership rules on your deployed version.
Sources
- Paperclip / server/src/services/approvals.tsSource checked 2026-09-26
- Paperclip / server/src/services/budgets.tsSource checked 2026-09-26