Security model
The question that matters is not whether the agent behaves. It is what a fully compromised agent key achieves.
| The attacker tries | Stopped by |
|---|---|
| Move the owner's tokens directly | The ERC-20 allowance. The guard is the sole approved spender |
| Classify a venue of its own as primary | VenueRegistry is keyed by owner |
| Register a wider mandate in the owner's name | EIP-712 recovery. The terms are the owner's signature or they are nothing |
| Release the action the guard held | Clause 4.2. No agent is an authoriser, and no contract lets it become one |
| Replay a mandate from another chain | The digest binds chainId and this registry |
| Rewrite a recorded action | The HCS commitment. An edited record no longer verifies |
In the drill, a stolen agent key moved 1,920,000 USDC — every unit inside the mandate, every proceed to the owner — and took away nothing. The guard holds no balance between actions.
Off chain, three more paths are closed and tested: a rewritten action fails its published commitment; a worker that fabricates a citation is struck before any model runs; and a decision the chain does not show is refused with 409.
Enforcement
contract only · no model originates a finding
no upgrade path · no admin key · no pause authority
no upgrade path · no admin key · no pause authority