{"id":"a4b46929-99d1-45fc-97b3-2a58c2cf2d9c","arxiv_id":"2608.09025","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"SAGE-Fin gates every financial-agent effect behind typed, state-checked receipts so that correct-sounding context cannot, by itself, authorize a response, trade, or policy.","lead":"This paper presents SAGE-Fin, a runtime control layer that checks whether a financial AI agent's proposed response, trade, or policy actually has permission to take effect, not just whether its text is true or relevant. It is worth reading because financial firms deploying AI agents need a way to keep fluent language from accidentally creating binding commitments, trades, or policies.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The guarantee is sound only if Γ maps natural-language proposals to the correct typed candidate, but the evaluation never exercises Γ on raw, ambiguous, or adversarial proposals; a miscompiled candidate can receive a valid receipt for the wrong effect.","rationale":"The reader's weakest assumption identifies Assumption 1's trusted compiler Γ as the most fragile link; I agree and sharpen the point. The issue is not merely that Γ is trusted, but that the paper's own evaluation strategy cannot measure Γ's fidelity. The formal proof is sound relative to the gate definitions, so all empirical weight falls on compiler correctness and on the input-to-candidate mapping. The 616/616 parity is genuine evidence for gate conformance, but the catalog supplies typed candidates rather than raw proposals, so it says little about whether Γ captures the requested effect. The retrospective production episodes are qualitative reconstructions and do not exercise Γ either. This is an external-validity gap rather than an internal inconsistency, and the authors acknowledge it in Section 10. CONDITIONAL remains the appropriate verdict: the mechanism is plausible and honestly scoped, but the central practical guarantee is not independently verified at the natural-language boundary. A released compiler plus an independent raw-NL benchmark could either support the claim or reveal a miscompilation path, which would require moving toward REJECT or substantially narrowing the claim.","tokens_in":21894,"tokens_out":5031,"duration_ms":53146,"concrete_test":"Release Γ (or provide an independent reimplementation from Definition 1) and run it end-to-end on a held-out benchmark of raw natural-language proposals: re-asks, negations, jurisdiction variants, ambiguous dialogue-to-policy phrases, and out-of-domain financial requests. Have an independent annotator label the correct candidate type, required witnesses, scope, and forbidden effects for each proposal, then compare against Γ's typed candidate. If any miscompiled candidate still proceeds to receipt issuance and gate acceptance, the practical reading of Theorem 1 is falsified; zero miscompilations on a sufficiently diverse benchmark would support it.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The formal result is true relative to Assumption 1, but the practical guarantee rests on the semantic fidelity of the deterministic compiler Γ. Theorem 1 (Section 6.3) proves that any governed effect has a prior accepted-type receipt whose candidate, artifact, subject, scope, cap, policy, time, and state bindings hold at consumption. The candidate bindings come from Definition 1: Γ(P_t, ξ_t) = (θ_t, φ_t, s_t, a_req_t, W_req_t, V_req_t, E_t). If Γ misreads a natural-language proposal—for example, compiling a commitment as a descriptive sop_response, resolving 'relax drawdown checks for institutional accounts after-hours' with the wrong scope or threshold, or omitting a forbidden effect—then the candidate type, required witnesses, coverage debt, issued receipt, and gate decision all inherit that misreading. A 'valid' receipt is then issued for an effect that was not in fact authorized; context has become authority through the compiler's blind spot. This is not an internal contradiction in Theorem 1, but it is exactly the failure mode the paper motivates. The evaluation never exercises this boundary. Section 8.2's 616-case catalog supplies candidates, issuance and consumption states, witnesses, receipts, and authored expected decisions; the parity harness maps fixture inputs to prototype interfaces. Γ is bypassed because every input is already typed. The three named response-gate fixtures and 22 tests cover selected paths, not raw adversarial or out-of-domain language. The three production episodes are retrospective reconstructions, not gate outputs. The authors are explicit in Section 10 that rules, mappings, and oracles were developed against the same catalog and that unparseable inputs fail closed, but the admission does not remove the gap: the central practical claim that no governed effect can happen without entitlement is unverified for precisely the input class (ambiguous, adversarial, or novel natural language) that the paper's threat model targets.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper identifies a failure mode it calls 'context-to-authority': a financial LLM agent can retrieve correct, fluent, well-sourced context and still lack runtime authority to emit a recommendation, execute a trade, or deploy a risk-control policy. It introduces SAGE-Fin, a runtime authority control plane in which a deterministic compiler Gamma maps natural-language proposals into typed candidates; witness and validator registries expose missing evidence as coverage debt; a dynamic controller computes an adapter-specific authority cap; and typed, non-substitutable receipts (commit, execAuth, deploy) are required at consumption-time gates. The formal part defines the candidate, debt, authority semilattice, receipt, and gate, and proves trace-level authority non-amplification (Theorem 1), receipt non-substitutability (Theorem 2), upstream-validation non-escalation (Proposition 2), execution- and policy-gate soundness (Theorems 3 and 4), state-contingent receipt revocation (Theorem 5), and monotone cap contraction (Propositions 1, 3, 5). Empirically, the paper reports an authored 616-case catalog with 3,080 specification outputs, 616/616 binary reference–prototype parity, 22 prototype tests, a label-isolated parity harness, three de-identified predecessor failures with independently confirmed 0/3 interception, and qualitative deployment feedback from a confidential digital-asset platform.","tokens_in":22242,"tokens_out":6467,"duration_ms":70967,"significance":"If the paper's central mechanism claim is accepted, SAGE-Fin is a useful, clearly specified design for making runtime financial authority explicit, auditable, and state-contingent. The formalization is clean and the paper is unusually disciplined about what the evaluation can and cannot show: it explicitly labels 616/616 as conformance rather than independent accuracy, discloses that the full-policy evaluator row is zero by construction against its own rejection set, and separates the three predecessor episodes and the later deployment from the public catalog evidence. The causal-filtration statement for the HMM regime witness (Proposition 4) is a nice touch, and the prospective replay protocol with explicit falsifiers (Table 9) is a genuinely useful contribution to how such mechanisms could be evaluated. The non-substitutable receipt/gate abstraction, while built from classical complete-mediation and usage-control ideas, is adapted to the financial-agent boundary in a way that should be reusable by other systems.","major_comments":[{"comment":"Theorem 1 is sound as a theorem about the gate, but it does not establish that the runtime governs the effect the user or model actually proposed. The candidate hash h_c binds to c_t^* = Gamma(P_t, xi_t), so the required witnesses, coverage debt, and eventual receipt bindings all inherit Gamma's output. If Gamma miscompiles an ambiguous or adversarial natural-language proposal—for example, resolving 'relax drawdown checks for institutional accounts after-hours' with the wrong scope or threshold, or compiling a commitment as a descriptive claim—then a valid commit, execAuth, or deploy receipt can be issued for the wrong effect, and Theorem 1 certifies the trace relative to that miscompiled candidate. The evaluation never exercises this boundary: the 616 cases in §8.2 are structured inputs with supplied candidates, witnesses, and receipts, and the 22 tests in §8.1 cover selected paths rather than raw, ambiguous, or out-of-domain proposals. Section 10 discusses parse failures and false rejection, but not semantic miscompilation. I do not count this as an internal inconsistency, but it is the central gap between the formal guarantee and the motivating 'context-to-authority' failure. Please either add targeted adversarial/ambiguous natural-language-to-candidate tests, or explicitly and prominently restrict the central claim to 'assuming faithful compilation of the proposal into the typed candidate' and adjust the abstract and conclusion wording accordingly.","section":"§6.3, Assumption 1 and Definition 7; §8.2"},{"comment":"The headline empirical results cannot provide external evidence that SAGE-Fin would reject unauthorized effects, because the prototype mapping, the full-policy oracle, and the authored labels were developed against the same catalog, and the full-evaluator row of Table 6 is zero by construction against its own rejection set. The paper states this limitation accurately, so this is not a fatal defect, but it does mean the 616/616 parity and the 0/587 contrast are self-consistency checks rather than validation. Given that these are the only quantitative results for the mechanism, the conclusions in §11 should be read as claiming mechanism conformance only. I would recommend adding an independent-label held-out split or an independently authored second catalog, even if small, to increase the empirical weight of the central mechanism claim.","section":"§8.2, Table 6; §11"}],"minor_comments":[{"comment":"The caption and the table heading 'Approvals / 587' are easy to misread: make the first column definition explicit in the caption itself, stating that the 587 cases are the cases the full policy defines as non-approvable, so that the 0/587 row is not read as a general accuracy denominator.","section":"Table 6"},{"comment":"The sentence 'The 29 full-policy approvals exercise permissive branches' initially appears to contradict Table 6's 0/587 full-policy row; clarify in the same paragraph that these 29 approvals are among the 90 cases that reach full evaluation (29 approved, 61 rejected), not approvals within the 587-case rejection set.","section":"§8.2"},{"comment":"The receipt abbreviation 'bud' is used in the non-substitutability discussion before Definition 6 lists the receipt types; define all receipt-type abbreviations (evd, bud, val, fxt, shd, commit, execAuth, deploy) at first use, ideally in Table 2 or in §5.5.","section":"§5.5 and Definition 6"},{"comment":"The label 'deployed path' in Figure 1 is ambiguous between the policy-deployment path and the execution-adapter path; rename it to something like 'enforced policy path' or draw separate arrows so the reader can map it to the policy adapter gate.","section":"Figure 1"},{"comment":"The regime thresholds theta_S, theta_I, and theta_H are free parameters with no guidance on selection; Proposition 5's monotonicity does not depend on their precise values, but the prototype's gate behavior does. A sentence on how these thresholds are set in the prototype, or an explicit statement that they are configuration inputs, would help.","section":"§7.1.3"},{"comment":"The wording 'second-analyst 0/3 confirmation' is clear, but the reader should also be reminded in the main text that the three episodes are a disclosure-approved convenience set, not a random sample, so their non-interception rate has no prevalence interpretation. The paper does say this later; moving a version of that caveat directly next to the 0/3 figure would prevent misreading.","section":"§8.3"}],"recommendation":"major_revision","confidential_remarks":"The paper's central formal contribution is sound relative to its stated assumptions, and the authors are exceptionally transparent about the limits of their empirical evidence. The main reason for major revision rather than acceptance is that the one load-bearing semantic step—the compiler Gamma translating natural-language proposals into typed candidates—is not tested at all, and it is precisely the step that connects the formal guarantee to the motivating 'context-to-authority' failure. I would also flag that the deployment evidence is unverifiable by design; it should not materially influence the editorial decision beyond what the public conformance study supports. The paper is a reasonable fit for cs.AI or a security/systems venue, and I would be comfortable with acceptance after the authors either add adversarial NL-to-candidate tests or explicitly narrow the claimed guarantee to perfectly compiled candidates."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: this is a solid design paper, not a validated safety result. The authors are unusually honest about what it is and is not.\n\nWhat's actually new is the authority contract itself: typed candidates, coverage debt, non-substitutable commit/execAuth/deploy receipts, and consumption-time re-derivation. That packages complete mediation, ABAC, UCON, macaroons, and AgentSpec into a finance-specific object with a trace-level non-amplification theorem. It's a real contribution at the design and formalization level, and it fills a genuine gap in the agent-governance literature.\n\nThe paper does several things well. The formal model is coherent: Theorems 1-5 follow from the definitions and Assumption 1, and the authors don't oversell. They explicitly label 616/616 as conformance rather than independent safety accuracy, Section 10 owns the circularity (rules, mappings, and oracles developed against the same catalog), and the prospective replay protocol in Section 8.4 is a thoughtful template. The failure taxonomy is useful framing.\n\nThe main soft spot is the compiler boundary. The paper's motivating claim is that context cannot become authority, but the formal guarantee depends on Gamma faithfully compiling natural-language proposals into the correct typed candidate. If Gamma misreads \"relax drawdown checks for institutional accounts after-hours\"--the paper's own example--the candidate, witnesses, coverage debt, and receipt all inherit the error, and you get a valid receipt for the wrong effect. Theorem 1 is true and the gate is sound, but the real-world guarantee is only as good as Gamma's semantic fidelity. The evaluation never tests Gamma on raw, ambiguous, or adversarial language: the 616-case catalog is pre-typed, the 22 tests cover selected paths, and the production episodes are retrospective reconstructions rather than gate outputs. So the central practical claim is unverified at exactly the boundary the threat model targets.\n\nThe circularity is real but admitted; the full-policy row being 0/587 by construction is fine as a mechanism check, not as an independent safety estimate. No artifacts are released, so a referee cannot rerun anything. The production evidence is qualitative and de-identified to the point of being uninspectable; the 0/3 interception on three predecessor failures grounds the taxonomy but estimates nothing.\n\nNone of this is fatal to the paper as a design and formalization contribution. The internal logic holds, the scoping is disciplined, and it should not be read as a validated safety guarantee. It deserves a serious referee: the design is coherent, the limitations are honestly stated, and the weaknesses are addressable. I'd send it to peer review with the expectation of major revision, primarily asking for Gamma to be exercised on raw natural-language inputs and for the fixtures to be released.","headline":"SAGE-Fin is a careful, well-scoped design and formalization of receipt-based runtime governance for financial agents; the formal claims hold under its stated trust assumptions, but the load-bearing compiler boundary is never tested on raw language and the empirical evidence is explicitly self-referential.","tokens_in":22907,"tokens_out":2371,"would_cite":false,"duration_ms":22286,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"For financial agents, correct context is not authority: every response, trade, or policy must carry a typed, state-valid receipt.","keywords":["financial AI agents","runtime governance","AI in finance","agent safety","auditability","risk control","receipts","context-to-authority failure"],"falsifier":"Run an ambiguous natural-language proposal—for instance 'relax drawdown checks for institutional accounts after-hours,' which leaves the drawdown window, institutional witness, fallback, and rollback unspecified—through the compiler $\\Gamma$ and policy adapter: if a deploy receipt is issued or enforcement begins while those unresolved fields are absent from coverage debt, the central claim fails. Equivalently, replay any stored trace in which a governed effect occurs with only a progress receipt (evd, bud, val, fxt, shd) present, or in which execution proceeds after a bound drawdown, freshness, regime, or incident predicate fails at consumption; Theorems 1 and 5 assert that both are impossible.","tokens_in":21647,"feed_emoji":"🛡️","tokens_out":12364,"duration_ms":102710,"temperature":0.7,"pith_summary":"This paper argues that financial agents can cause real harm—a customer-facing commitment, a trade, a deployed policy—while the words they emit are factually correct, fluent, and well sourced, because correct context is not the same as runtime authority. It presents SAGE-Fin, a finance-specific authority-handoff contract that makes the proposed effect, not its text, the object of control: a deterministic compiler turns each proposal into a typed candidate, missing or stale institutional obligations become visible 'coverage debt,' and no response, trade, or policy may be emitted without a receipt whose nominal type matches the consuming adapter and whose state bindings still hold at consumption. If the mechanism works as claimed, the failure class in which fluent language outruns structured verification—repeated emissions, stale fee quotes, verbal risk-control instructions becoming enforceable policy—is closed at the runtime boundary, without any assertion about profitability or legal compliance. The paper's evidence is deliberately scoped: 616/616 parity on an authored 616-case catalog with 3,080 specification outputs establishes executable conformance, not independent safety accuracy, and the production feedback is qualitative corroboration rather than an effect estimate.","feed_headline":"No trade, response, or policy fires without a valid typed receipt","feed_subtitle":"A finance-specific runtime contract stops correct, well-sourced context from becoming unauthorized action.","key_machinery":"The load-bearing object is the authority-handoff contract that joins five components at consumption time: the re-derived typed candidate $c^\\star_t = \\Gamma(P_t, \\xi_t)$ produced by the deterministic compiler; the witness and validator registries whose gaps surface as coverage debt $D_t$; the exact serialized artifact $x_t$; the current runtime state $\\xi_t$; and a receipt $R$ whose nominal type belongs to {evd, bud, val, fxt, shd, commit, execAuth, deploy}, with only commit, execAuth, and deploy accepted by the response, execution, and policy adapters respectively. The consumption-time gate (Definition 7) conjoins trusted issuance, receipt-type membership, candidate and artifact hash bindings, subject, scope, and policy matches, the time window, consumption-time state predicates, empty blocking debt, permitted effects, and cap ordering on a per-adapter authority semilattice $(A_g, \\preceq_g, \\wedge_g)$. That conjunction—no single component in isolation—is what makes evidence and workflow progress unable to substitute for effect authority, and it is the mechanism the proofs in Theorems 1–5 run on.","core_discovery":"The central claim is trace-level authority non-amplification: in any finite sequence of proposal, issuance, state-update, and consumption events, no governed effect occurs without an earlier trusted issuance event for a receipt of a type the consuming adapter accepts, whose candidate, exact-artifact, subject, scope, cap, policy, time, and state bindings all hold at consumption, with no blocking coverage debt (Theorem 1, Section 6.3). Progress receipts—evidence, budget, validation, fixture, shadow—can never authorize an effect because their nominal types lie outside the acceptance sets of the response, execution, and policy adapters, and an upstream evidence or language-validation pass can discharge an obligation but cannot compose into downstream permission (Proposition 2). Authority is re-derived rather than cached: the compiler $\\Gamma$ recompiles the candidate from current proposal and state, so the same surface text can lose its authority between turns (Remark 1), and a receipt valid at issuance is rejected if any bound predicate fails at consumption (Theorems 5 and 3). The result is a soundness guarantee for a fully mediated runtime under the paper's stated trust assumptions; the 616-case catalog and 22 tests demonstrate that the prototype conforms to its own declared semantics, which the paper distinguishes from independent safety accuracy.","pith_inferences":["Editorial inference: the same contract shape—typed candidates, coverage debt, exact-artifact receipts, consumption-time revalidation—could be ported to other domains where natural language crosses an authority boundary, such as medical advice or legal commitments, by redefining candidate types, witness registries, and adapter receipts.","Editorial inference: the authors' own admission that one-shot reuse of the same receipt for the same artifact is outside the current prototype points to the natural next mechanism—an atomic spent-receipt ledger—which would extend Theorem 1 from 'an earlier issuance exists' to 'a single non-reusable consumption occurred.'","Editorial inference: because $\\Gamma$ is the boundary where natural language becomes typed authority, an adversarial-robustness study of the compiler against ambiguous, contradictory, or jailbroken phrasing is the direct next experiment; the current evidence deliberately does not exercise raw adversarial language.","Editorial inference: a testable deployment extension is a privacy-preserving replay of historical customer-service interactions with independent labels, which would convert the paper's three qualitative predecessor episodes into a measurable interception rate and bounded false-block counts."],"forward_implications":["A correct, well-sourced answer cannot be emitted on context alone: the response adapter accepts only a commit receipt bound to the exact artifact and still valid under the current dialogue and account state.","Entering a workflow, reserving budget, passing a language or evidence check, or validating a policy grants audit evidence but never execution or deployment authority; only the matching execAuth or deploy receipt can do that.","Prior authorization is not portable across turns: because the candidate is recompiled from current state, effectively unchanged text can carry different authority after dialogue, freshness, portfolio, incident, or policy changes.","Stale or missing obligations become visible coverage debt that contracts or blocks the authority cap instead of being masked by fluent prose, and reconciliation of outcomes contracts future authority on the affected scope.","Every governed effect on a mediated runtime becomes reconstructable from its trace: the exact artifact, its receipt, the witnesses, and the state predicates that held at consumption."],"supporting_citations":[{"why":"Supplies the complete-mediation principle—every access is checked at the gate—that Theorem 1 assumes for all governed effects.","marker":"[23]"},{"why":"UCON usage control: mutable attributes and authorization during ongoing use, generalized here to consumption-time revalidation and state-contingent revocation.","marker":"[19]"},{"why":"Attribute-based access control (ABAC): the attribute-decision foundation the SAGE-Fin controller extends with finance-specific candidates, coverage debt, and typed receipts.","marker":"[13]"},{"why":"Macaroons with contextual caveats: the delegated-credential precedent for typed, attenuated, scope-bound receipts.","marker":"[3]"},{"why":"AgentSpec runtime enforcement for LLM agents: the generic trigger–predicate–enforcement approach SAGE-Fin specializes to the finance lifecycle.","marker":"[26]"},{"why":"CBEA+LCV, the upstream evidence-activation and language-commitment validation boundary that SAGE-Fin explicitly does not replace; Proposition 2 formalizes the non-escalation between them.","marker":"[24]"},{"why":"The HMM forward recursion and Baum–Welch estimation used by the optional latent-regime witness that contracts execution authority.","marker":"[20]"},{"why":"The EU MiCA crypto-asset regime that motivates deterministic, receipt-gated policy deployment instead of dialogue-derived enforcement.","marker":"[7]"}],"fun_headline_variants":["Correct context ≠ authority: SAGE-Fin enforces typed receipts for every effect","No effect fires without an exact-artifact receipt: SAGE-Fin runtime","SAGE-Fin: receipts, not context, authorize trades, responses, and policies","Financial agents: context is necessary, but receipts are the only authority","SAGE-Fin: authority re-derived from each state, never cached from context"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee collapses if the deterministic compiler cannot faithfully translate natural-language proposals into typed effect candidates, because every downstream receipt inherits whatever the compiler mis-reads; the paper's own evaluation never runs raw, adversarial, or out-of-domain language through that compiler, since its 616-case catalog is structured and authored.","fun_headline_variants_meta":{"raw":{"variants":["Correct context ≠ authority: SAGE-Fin enforces typed receipts for every effect","No effect fires without an exact-artifact receipt: SAGE-Fin runtime","SAGE-Fin: receipts, not context, authorize trades, responses, and policies","Financial agents: context is necessary, but receipts are the only authority","SAGE-Fin: authority re-derived from each state, never cached from context"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001022,"raw_usage":{"total_tokens":4387,"prompt_tokens":1097,"completion_tokens":3290,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":713,"completion_tokens_details":{"reasoning_tokens":3187}},"tokens_in":713,"tokens_out":3290,"duration_ms":24560,"temperature":1.0,"reasoning_tokens":3187,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:17:48.511410+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an ambiguous natural-language proposal—for instance 'relax drawdown checks for institutional accounts after-hours,' which leaves the drawdown window, institutional witness, fallback, and rollback unspecified—through the compiler $\\Gamma$ and policy adapter: if a deploy receipt is issued or enforcement begins while those unresolved fields are absent from coverage debt, the central claim fails. Equivalently, replay any stored trace in which a governed effect occurs with only a progress receipt (evd, bud, val, fxt, shd) present, or in which execution proceeds after a bound drawdown, freshness, regime, or incident predicate fails at consumption; Theorems 1 and 5 assert that both are impossible.","supporting_citations":[{"cited_title":"Saltzer and Michael D","cited_arxiv_id":null,"evidence_quote":"Supplies the complete-mediation principle—every access is checked at the gate—that Theorem 1 assumes for all governed effects."},{"cited_title":"2004.The UCONABC Usage Control Model.ACM Transactions on Information and System Security7, 1 (2004), 128–174","cited_arxiv_id":null,"evidence_quote":"UCON usage control: mutable attributes and authorization during ongoing use, generalized here to consumption-time revalidation and state-contingent revocation."},{"cited_title":"Recall Isn't Enough: Bounding Commitments in Personalized Language Systems","cited_arxiv_id":"2605.16712","evidence_quote":"CBEA+LCV, the upstream evidence-activation and language-commitment validation boundary that SAGE-Fin explicitly does not replace; Proposition 2 formalizes the non-escalation between them."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The HMM forward recursion and Baum–Welch estimation used by the optional latent-regime witness that contracts execution authority."},{"cited_title":"2023.Regulation (EU) 2023/1114 of the European Parliament and of the Council on Markets in Crypto- Assets (MiCA)","cited_arxiv_id":null,"evidence_quote":"The EU MiCA crypto-asset regime that motivates deterministic, receipt-gated policy deployment instead of dialogue-derived enforcement."}],"review_version":1}