An agent can assemble an exposure nobody authorised out of steps that each pass. AMW checks the composition before settlement, holds it, and hands a named human the case file.
Runner-Up · C:\>DIR Global ‘Agentic Regulator’ Hackathon 2026, in the Decentralised Market Infrastructure, Smart Contracts & AI Agents problem space. The Ethereum Foundation supported that space. One of 36 finalists drawn from 336 entries across 65 countries.
One question, asked nine times and answered honestly. Nobody asks the tenth.
“Is this action allowed?”
240,000 against a 250,000 cap. Classified venue, named agent, unexpired mandate.
Answered nine times: yes“What do these nine amount to?”
2,160,000 against a 2,000,000 bound. 3,333 bps off-primary against 2,500. All of it from permitted parts.
Asked by nothing on chainFinance named this fifty years ago and made it an offence. It is called structuring: a reportable amount cut into unreportable slices. An agent needs no intent to produce it. A sizing loop will do.
The contract’s own arithmetic, running here. Move a bound; the hold moves with it.
EIP-712, identified by its own digest. A child may only narrow its parent: widening is impossible, not flagged.
The guard is the sole approved spender. Every intent is recorded before it passes or fails, so a hold leaves a trace instead of vanishing in a revert.
Aggregate, count and off-primary share, checked against what the action intends, across every ancestor, so delegating is not the way around it.
Workers draft the language; the arithmetic and the striking gate use no model. A claim whose citation does not resolve never reaches the page. The authoriser signs the release.
Tier 1 is what an action is. Tier 2 is what a sequence becomes. Same instrument, same contract, both enforced before value moves.
The three marked clauses are properties of a sequence. No per-action guardrail can evaluate them.
Not misconfigured. Held by someone hostile who can sign anything the agent could.
Exactly what the mandate permits, every unit of it recorded before it happens.
A cap that reads as 250,000 an action composes to 2,160,000 in an hour. The owner learns that after the incident.
Nothing breached, no bound failed. A fact its owner was entitled to before signing.
Take the sandbox and press Search what it permits.
Their kits, their ground truth, their scorer. A benchmark published only when it agrees with you is a press release.
A violation counts as caught only when a clause about it cited it. Every bar is their scorer’s, on their ground truth.
0ms latency on every run: the guard holds the intent before value moves, so there is nothing to be late for.
It is the boundary of the product, drawn by somebody else. Both families it misses — a mule merchant across six beneficiaries, a synthetic identity — were written down as limits before the kit was run.
Every false positive is one clause: an action count their programme never states and this one cannot leave out. Set those aside and precision is 100%. Both figures are published; averaging them would hide the second.
Nothing here has to be taken on trust. The contracts are source-verified, the incident and its commitments are on chain, and every address below opens on HashScan, a public explorer this project does not run.
npm run -w @amw/contracts gate2
Nine actions from an agent key holding nothing. The ninth is held.
npm run -w @amw/contracts gate7
The compromised-agent drill, in fifteen seconds.
npm run -w @amw/relay gate10
A key funded with nothing signs six things and sends no transaction.
npm run verify
The suite, each test named after the attack it refuses.
The incident, the case file behind the hold, and a preview answered by the enforcement bytecode itself. No wallet needed.