Google Multi-Party Compute uses a policy engine running inside Google Cloud Confidential Space to check transactions against spending caps, destination restrictions, and multi-person authorization rules before signing.