Authority boundary
Controlled connection model
i
The middleware connects and translates. It cannot originate financial decisions, choose postings or present financial state directly to applications.
Gateway/Operations overview
Live institutional posture
Operations overview
Connection integrity, ecosystem risk and delivery health across the Threasury Gateway.
Enforced
Durable backbone · 24 hours
Canonical event flow
◌
Awaiting event telemetry
PublishedDeliveredDead letter
Governed consumers
Delivery pipelines
Prioritised assurance
Compliance signals
✓
No open signals
Tamper-evident trail
Latest activity
Ecosystem topology
Connected apps
Govern every FEI, Ledger, BFF, partner, provider and institutional service connection.
| Connection | Type & zone | Environment | Authentication | Health | Last signal |
|---|
Four-eyes governance
Approvals
Review consequential integration changes with evidence, expiry and separation of duties.
| Request | Target | Risk | Requested by | Expires | Status |
|---|
Trust & assurance
Compliance alerts
Investigate policy, screening, certificate, reconciliation and security-assurance signals.
Regulated provider evidence
External screenings
Request and track sanctions, PEP, registry, identity and fraud screening without moving decision authority into the Gateway.
| Screening | Subject reference | Provider | Jurisdiction | Outcome | Evidence | Requested |
|---|
Deterministic escalation
Alert routes
Route governed alert categories to approved operational destinations with deduplication and escalation controls.
Institutional ecosystem
Partner operations
Manage governed progression, capability posture, certificates and operational requests by legal entity.
Governed registry
Partners
Lifecycle queue
Operations
Credential governance
API keys
Issue, rotate and revoke scoped application credentials. Secret material is shown once and stored only in the governed secrets plane.
◇
Production credentials require deliberate control.
Use mTLS-bound OAuth for institutional partner access wherever available. API keys are intended for approved service integrations and operator bootstrap only.
| Credential | Owner | Environment | Scopes | Last used | Status |
|---|
Tamper-evident operations trail
Activity feed
Trace connection, security, compliance, partner and event activity through hash-linked operational evidence.