Security model
The question that matters is not whether the agent behaves. It is what a fully compromised agent key achieves.
| The attacker tries | Stopped by |
|---|---|
| Move the owner’s tokens directly | The ERC-20 allowance. The guard is the sole approved spender |
| Classify a venue of its own as primary | VenueRegistry is keyed by owner |
| Register a wider mandate in the owner’s name | EIP-712 recovery. The terms are the owner’s signature or they are nothing |
| Release the action the guard held | Clause 4.2. No agent is an authoriser, and no contract lets it become one |
| Replay a mandate from another chain | The digest binds chainId and this registry |
| Rewrite a recorded action | The HCS commitment. An edited record no longer verifies |
In the drill, a stolen agent key moved 1,920,000 USDC, every unit inside the mandate, every proceed to the owner, and took away nothing. The guard holds no balance between actions.
Off chain, three more paths are closed and tested: a rewritten action fails its published commitment; a worker that fabricates a citation is struck before any model runs; and a decision the chain does not show is refused with 409.
Enforcement
contract only · no model originates a finding
no upgrade path · no admin key · no pause authority
no upgrade path · no admin key · no pause authority