AI Agent Guardrails
Every AI agent bound to an accountable operator, and wrapped in constraints enforced at validation rather than requested politely at the SDK.
The policy object
The whole enforcement surface, small enough to review before an agent is bound to it. Every field is hashed into a policy digest, so what was enforced is provable after the fact. recipientAllowlist is the field most guardrail products leave out: constraining which contract and how much, but never to whom, leaves an in-policy agent free to send its whole daily allowance to a fresh address.
- agentId
- targetAllowlist
- selectorAllowlist
- recipientAllowlist
- maxValuePerOpUsd
- maxSpendPerDayUsd
- maxOpsPerHour
- unknownTargetCapUsd
- unknownRecipientCapUsd
- newRecipientDelaySecs
- validAfter
- validUntil
- paused
Graduated autonomy
Enumerate-everything or open the door is a false choice, and an agent whose job is to discover counterparties cannot work under the first. An unlisted target or recipient is permitted only under a materially lower cap the operator sets deliberately, and a first-seen destination waits out a cooling-off period. Both default to zero, which means refused.
Where it is enforced
Two points, with honestly different properties. Agent-side, the module installs on an ERC-7579 smart account as a type-1 validator and enforces inside validateUserOp, the one place a leaked key cannot argue with it. Receiver-side, a protected contract calls enforce() with the real amount and destination, the only place the true magnitude is known. Exactly one of the two records per account, so an operation is never counted twice. USD at validation comes from an operator-set scale rather than an oracle call, because ERC-4337 forbids external calls during validation; an unpriced token is refused, never assumed.
- ERC-8004
- ERC-4337
- ERC-7579
- EAS operator bindings
The kill switch
paused takes effect at validation rather than at the next deploy, and pausing a parent agent pauses every sub-agent beneath it. Like every on-chain write path here it ships disarmed, so the console reports which half of the switch an operator has armed, in those words. A dashboard reading PAUSED while the key is still honoured somewhere is worse than no kill switch at all.
Behavioral watch
Baselines are learned per agent from observed on-chain activity and compared against the declared policy and the agent's own history: value outliers against a 95th percentile, operations in hours it has never used, velocity against its busiest hour, bursts of never-seen counterparties, and a large first move after dormancy. Robust statistics throughout, so one large legitimate operation does not raise the bar it is next judged against. Statistical rules stay silent until an agent has enough history; declared-scope rules fire from the first operation.
Reputation
Per-domain and operator-bound. An agent's history follows the operator who is accountable for it rather than the key, which is the only version that survives key rotation.
Where the boundary sits.
In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.
Put AI Agent Guardrails on your perimeter.
Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.