Does the platform ever move the disbursed funds itself?

No. Once the required signers authorize a disbursement, the system transitions its recorded state from authorized to signaled and sends a webhook instructing the receiving foundation to execute the transfer on its own payment rails. The platform never initiates any transfer of funds itself.

What happens if the receiving party's webhook endpoint is briefly unreachable?

Delivery is retried on a bounded schedule up to a fixed maximum number of attempts, each cryptographically signed, so a temporarily unreachable receiver does not silently cause a signaled disbursement instruction to be lost.

Threshold-Tiered Multi-Signer Disbursement with Foundation-Executed Settlement Webhook

Q: How does the required number of signers change with disbursement size?

It escalates in tiers by dollar amount: a small disbursement requires a single signer, larger tiers progressively require two signers, then two signers plus a finance role, then two signers plus finance plus a program director, and the largest tier additionally requires board-level attestation.

Executive Summary

Disbursement authorization escalates the number and seniority of required signers strictly as a function of the disbursement's dollar amount — a small disbursement requires one authorized signer, and progressively larger tiers require two signers, then two signers plus a finance role, then two signers plus finance plus a program director, with the largest tier additionally requiring board-level attestation. At no point does the platform itself hold or move the funds.

Once the required signer threshold for a disbursement is satisfied, the system transitions the disbursement's recorded state from AUTHORIZED to SIGNALED and fires a cryptographically (HMAC) signed webhook to the receiving foundation or entity that explicitly declares its own custody posture — that the platform never holds the disbursed funds — and instructs the receiving party to execute the transfer on its own banking or payment rails. Webhook delivery is retried on a bounded schedule with a fixed maximum attempt count, so a temporarily unreachable receiver does not silently drop a signaled disbursement.

Core Innovation: Authorization escalation and actual money movement are structurally separated — the system proves it is architecturally incapable of executing a disbursement itself by embedding its own custody posture into the machine-readable payload of every webhook it sends.

Problem Statement

Custodial disbursement platforms make the platform itself a single point of failure or compromise for an entire treasury, since it is the one moving the money. Flat multi-signature thresholds apply the same signer count regardless of whether a disbursement is a few hundred dollars or several million, either too strict for small amounts or too loose for large ones, and generic notification systems commonly conflate "internally authorized" with "money actually moved."

Signer-requirement tiers, scaling with disbursement amount

Webhook delivery attempts on a bounded retry schedule

Transfers the platform itself ever executes

Why Existing Solutions Are Insufficient

Custodial disbursement platforms: the platform itself moves the money, making it a single point of compromise for the entire treasury.
Flat multi-sig thresholds: the same N-of-M signer requirement applies regardless of whether the disbursement is small or enormous.
Fire-and-forget notification systems: no retry discipline, so a transient outage at the receiving party can silently drop a critical instruction.
Systems conflating "authorized" with "executed": no explicit signaling state distinguishing internal sign-off from the money actually having moved on the receiving party's own rails.

Technical Architecture

Amount Threshold	Required Signers
≥ $25,000	1 authorized signer
≥ $250,000	2 signers
≥ $1,000,000	2 signers + finance role
≥ $5,000,000	2 signers + finance + program director
> $5,000,000	All of the above + board-level attestation

Authorized-to-Signaled State Transition

Once the amount-appropriate signer set has authorized a disbursement, the system's own state for that disbursement transitions from AUTHORIZED to SIGNALED. This transition occurs entirely within the system's own record-keeping and never involves the system itself initiating a transfer of funds.

Custody-Posture Declaration

The webhook payload sent on the AUTHORIZED-to-SIGNALED transition explicitly embeds a declared custody-posture field — stating that the platform never holds the disbursed funds — and an instruction directing the receiving foundation to execute the transfer using its own payment rails, making the platform's non-custodial posture machine-readable rather than merely a policy statement in documentation.

Bounded, Signed Retry Schedule

Webhook delivery is retried on a fixed backoff schedule for up to a maximum number of total attempts if the receiving party does not acknowledge receipt, and each attempt is cryptographically (HMAC) signed so the receiver can independently verify the webhook's authenticity regardless of transport-layer security.

Prior Art Differentiation

Approach	Who Moves the Funds	Signer Scaling	Delivery Guarantee
Custodial grant/disbursement platforms	The platform itself	Fixed or none	Varies
Flat-threshold multi-sig treasuries	The treasury's own signers	Same for every amount	Varies
Generic webhook notification systems	N/A	N/A	Fire-and-forget, no bounded retry
JIL Sovereign	Receiving foundation, on its own rails	5 tiers, amount-scaled	Bounded, HMAC-signed retry

Patent Claim

Independent Claim 94: A computer-implemented method for authorizing fund disbursements, comprising: determining, for a proposed disbursement, a required number and role composition of authorizing signers by comparing the disbursement's amount against a plurality of configured amount thresholds, such that a larger disbursement amount requires a strictly greater or differently composed set of authorizing signers than a smaller disbursement amount; transitioning the disbursement's recorded state from an authorized state to a signaled state upon collection of the required signers, without the computer system itself initiating any transfer of funds; and transmitting, upon the transition to the signaled state, a cryptographically signed webhook notification to a receiving party, the notification comprising a declared custody posture indicating that the transmitting system does not hold the disbursed funds and an instruction directing the receiving party to execute the transfer using its own payment rails, the transmission retried according to a bounded schedule of a fixed maximum number of delivery attempts upon failure to acknowledge.