Your agent can be fooled. Know who pays.

For vendors of accounts-payable agents. A spending limit stops the payment it can recognize. It can’t stop the one your agent is talked into, like a bill it already paid, with a fake note from the controller. Back your agent with money: a named guarantor locks funds on NEAR, and if the arbiter named in the mandate finds the agent was fooled inside its limits, your customer is repaid from those funds, minus its share.

Try the demoSee the numbersGitHub
The whole loop, in 30 secondsAnimation, no transactions

Do it yourself

Fool a real model. Then decide who pays.

One mandate, a real model, real testnet transactions signed in your browser. The money goes to a test seller.

The scene

Northwind Ltd. lets an AI agent pay supplier invoices, and its instructions are to pay only what matches an open order. The agent’s vendor stands behind it: a guarantor has locked money on NEAR. You’ll play the accounts team, then the company, then the arbiter. It’s testnet money, with each budget link worth 0.01 USDC.

Northwind’s ledgerItemAmountStatus
PO-77Paper stock1 linkPaid by INV-1
PO-78Toner2 linksOpen

What a link is, and how the model was measured

A link is one unit of the agent’s budget, 0.01 USDC here. An employee releases links one at a time; the agents under that employee are its tree. The fake controller note and the real purchase may reuse the model’s last answer, to save free quota: change a word and the model reads it live. The agent’s ledger: PO-77 paper stock, already paid by INV-1. PO-78 toner, 2 links (0.01 USDC each), open. Llama 3.3 on Cloudflare’s free tier, not NEAR AI, no TEE. Measured twice, 2026-11-03 and 11-04, 10 runs each at low temperature, so the runs are close to repeats: plain re-bill paid 0 of 10, fake controller note 10 of 10, real purchase 10 of 10, mismatched invoices 0 of 30. A small sample, not a rate.

What a firewall catches, the contract refuses too.

Three of the invoices above break a rule the contract can read. The fake controller note breaks none of them. The money went to a seller you approved, so ask for it back first. Cover is for when that seller won’t return it.

SCOPEA payee who isn’t in the mandate.
PER_TXMore than the cap on one payment.
DUPLICATEAn invoice number already paid.

An earlier sandbox run: two Gemini models followed injected invoices in 13 of 20 attacks, and none of those payments went through (2 models, 5 attacks, 2 runs each; results). It shows the rules hold whichever way the model goes, not how often models fail.

What would it cost to back your agent?

Nobody has data on how often agents get fooled, so we can’t give a price. Type what you’d have to believe. The limit follows how fast you notice, not how much you spend: filing a claim stops the agent. Fully locked money is why this costs what it does: what the guarantor locks, it can’t lend or reuse. On these numbers a company shouldn’t buy this for itself. The buyer we have in mind is the agent’s vendor, with no fee, paying to win customers. Nobody has agreed to that. Why lock money instead of signing a warranty? A small vendor’s promise is worth what its balance sheet is; a locked stake can be read before signing.

Lowest yearly guarantee fee…
Limit the guarantor locks…
Fee, % of the limit…
Fee, % of what the agent pays…
A company paying this gets back, per $1 of fee…
Cost to a vendor charging no fee, before running costs…
Locked money alone, with no losses and no costs…
The demo’s 2% per 30 days, a year…
Loss rate that demo fee could absorb…

Read “gets back” first: below $1 means a company paying for itself loses on average, so someone else may have to pay. The demo’s fee is a placeholder, not a price. fee = (cost of money + loss rate × (1 − your share)) / (1 − running cost). Worked out, with sources.

If a company’s agent is fooled today, who pays?

What we could find, and where Writ loses. Nobody has been interviewed yet. Agents can be talked into paying: an X user reportedly got Grok and Bankrbot to transfer tokens then valued at about $200,000; linked funds were later returned or converted, and a payee list would have refused it. People get fooled the same way: the FBI’s IC3 logged $3.05 billion lost to email compromise in 2025. We haven’t found a public case of an agent losing money to a seller it was allowed to pay, which is the case cover is for. Public comment leans against us: “Most of these are engineering problems, not insurance problems,” and what’s left may be a “thin residual.” Someone else asks our question, but as a reason not to use agents at all: “who do you call when it… falls for prompt injection and pays a scammer?” We agree with the first part, and it’s why the agent’s vendor is the one to back it: a vendor with money at stake has a reason to build the checks. Whether what’s left is worth locking money for is the open question. All of it, with sources.

TodayWho paysWhere it beats WritWhere Writ beats it
The company, with a spending limitThe company. The limit caps the loss; nobody repays it.Free, and available now.Someone else’s money is named before the agent spends.
A card networkAmex announced Agent Purchase Protection for charges from registered agent error (as reported; we haven’t read the terms). Worldpay says “no liability shift exists yet”.Real issuers, real customers, nothing to lock.Agent payments off cards, and terms anyone can read before the agent spends.
AI liability insurersArmilla, AIUC and Munich Re cover things like hallucination (as reported). We found none covering agent payments, which doesn’t mean none exist.Licensed, with real balance sheets and real claims teams.The money is locked where you can check it.
A crime or cyber policyYour insurer, if the wording reaches a fooled agent. Crime cover for social engineering “is often capped at a sublimit of $250,000 or less”, and some policies need staff to confirm bank changes by a separate call. We haven’t found a policy or a ruling that addresses an AI agent.Licensed and pooled, likely cheaper, and you may already have it. Check this first.Terms written for an agent, and money locked where you can check it.
On-chain coverNexus Mutual has covered crypto risks since 2019; a claims committee votes on each claim. We found no product of theirs for agent payments, which doesn’t mean none exists.Years of real claims and real capital.Terms written for one agent’s mandate, with its tree stopped by the claim.
A vendor contractWhatever the company negotiated with the agent’s vendor. We haven’t surveyed these.The company may already have one, and no money is locked.A limit and an arbiter that any seller or auditor can read.
WritThe guarantor named in the mandate, up to the limit, if the arbiter upholds. The company keeps its share of each loss.No real guarantor exists. It costs more, because every dollar of the limit stays locked. The arbiter is a person you must trust. It may be regulated, and no lawyer has reviewed it.

Who pays is named before the agent spends.

Before

A guarantor is named

It signs the mandate, takes any agreed fee and locks the full limit in its stake. It can’t withdraw that lock while cover runs. Our first guess at who: the vendor of the agent, standing behind its own product. Nobody has agreed to that yet.

While it spends

Every payment is recorded

The contract checks payee, invoice, cap, budget, rate and expiry, and keeps the hash the agent reports of what it read and decided.

When it’s fooled

The arbiter decides

The company files a claim and its whole tree stops. The contract can’t tell if the agent was fooled, so a named arbiter rules. The limit caps what a wrong ruling costs.

After

The stake repays

The loss, minus the company’s share, moves from the stake to the company. The tree stays stopped until the company clears its agent.

Who pays · live on testnet · …
Guarantor
reading the contract…
Locked
…
Customer absorbs
…
Arbiter
…
Claims paid
…
Upheld, denied
…
Agent
…

A demo guarantor. The rulings are visitors clicking this page.

Check this card yourself
…

The guarantor checks who the company is off-chain, with GLEIF’s vLEI credentials and KERI; here the issuers are mocks.

Why NEAR. The contract holds its agents’ function-call keys on its own account and can delete them, and it has no full-access key. The protocol refuses any other method before contract code runs, and a revoked agent’s transactions never get created. The arbiter can be a council too: a Sputnik DAO upheld and denied a claim on testnet, with demo accounts voting.

The numbers, and the commands behind them.

126attacks blocked in the benchmake test 104 + 111integration and unit tests passmake test 36credential forgeries refusedmake keri-check 853 / 863mutants caught, over two runs; the 10 left are explainedcargo mutants PASSthe whole cover story, end to end: COVER_RESULTmake cover-demo

From CI run 41704113063. Reviews were done by AI agents and tests, not an audit firm.

All known limits
  • The owner can take a guarantor’s free stake. It can overwrite the guarantor’s key, sign a mandate in its name, and collect a default. Found by reading the code in review, not run. A real deployment needs a timelock or the guarantor’s own signature; the contract has neither, and its owner is a demo account. The threat model has two smaller ones from the same review.
  • Moral hazard is capped, not stopped. A company that fools its own agent, with a seller it controls, can take the loss minus its share, up to the limit, if the arbiter upholds.
  • Seller refunds are invisible. If a seller refunds a fooled payment, the contract can’t see it, so a company could be repaid twice. The terms ask for a statement; nothing on-chain checks it.
  • No company-wide total. Each mandate has its own limit. Nothing adds up a company’s mandates or a guarantor’s view of them.
  • A guarantor can revoke early and keep the fee for periods already started. Later periods go back to the company, up to its free stake. The fee is charged up front, when the guarantor chooses to activate in the first half of the term. Its lock stays until the mandate’s term and claim window have passed.
  • Whether this is insurance is unknown. We don’t claim to be a licensed product. It depends on the jurisdiction, and no lawyer has reviewed it. A guarantor would need its own licence or legal opinion. No real users, testnet only.
  • A fooled payment inside every limit, to a permitted payee, for a new invoice, still gets paid. Cover repays it afterwards, up to the limit, if the arbiter upholds.
  • This page holds the company’s and the arbiter’s restricted keys, so any visitor can file, rule and clear. Money only moves to the company’s account. A real mandate has a real arbiter.
  • The demo’s arbiter has 60 seconds and a payment can be claimed for 10 minutes; the contract’s default for the arbiter is 14 days. An open claim stops the agent for every visitor, and the budget has a low daily rate, so the page can run out for a day. The page’s keys spend a gas allowance anyone can burn, and it says so when one runs out.
  • The model is on a free tier: the quota can run out, and the page says so. Payment answers to two preset invoices are cached for a day, and the page says when.
  • The vLEI schemas are GLEIF’s; the issuers are mocks with a fictional LEI, and no real QVI issued anything. The Agent Mandate Credential schema is a proposal, since GLEIF has not published one.
  • The fee here is a demo number. Who would guarantee an agent, and at what price, is an open commercial question. The terms text is a placeholder no lawyer has reviewed.
  • A guarantor that also holds the company’s legal-entity key could name that company falsely: the contract checks the signature, and the link between that key and the LEI is checked off-chain.
  • This page’s config holds the fictional company’s LEI and salt so the guarantor’s step runs in your browser; a real guarantor keeps them private.
  • The company’s LEI stays a commitment until it is disclosed, but funding accounts and payments are public and linkable.
  • Revocation takes effect when the signed event reaches the contract; no relayer ships with the repo.
  • Disclosure takes the guarantor’s action, since it holds the salt, and it does not happen if money left in the tree repays the debt. Closing affects the agents under one mandate, not every mandate the company has.
  • The buttons on this page sign real testnet transactions, with short windows so you can watch them: 15 seconds to due, 20 seconds of recourse. The guarantor’s steps run from this page. In the net-30 and firing stories the agents are scripted; only “Fool a real model” calls a model.

The threat model has the rest. make verify reruns the build, the bench, the stories and the credential checks, and prints a scorecard.

More from the same contract

It also blocks a stolen agent key, backs net-30 orders for sellers, and stops a tree when an employee leaves.

This is an AI agent’s private key. Steal its money.

With a plain spending limit, a thief holding the key can spend up to that limit. Here, without the employee’s next budget link, the key alone moves nothing. A thief who also takes released links can spend those, to permitted payees only.

loading…
…NEAR IN VAULT
…ATTEMPTS REJECTED
…BUDGET USED

Contract has no full-access key. This agent’s budget is in NEAR and it keeps its key after failures. This is a different agent from the one above: its links are not on this page. Find a way to move the money without a released link? Open an issue.

    Same stake, second use: net-30 for sellers.

    The guarantor’s stake can also back an order on credit. You don’t need to know the company; the guarantor does, and it approved your account in the mandate first. Set a rule. If the buyer doesn’t pay, claim it, with no one’s approval.

    Your rule
    …
    Next order · …
    Company
                     sealed
    Guarantor
    …
    Staked
    …
    Term
    …
    Credit limit
    …
    Bond
    …
    Fee
    …
    Record
    …
    AP agent…
    REVOKED
    Procurement…
    REVOKED
    Quotes…
    REVOKED
    Check this card yourself
    …
    1

    An order arrives. Read the card.

    Demo setting: how will this company behave?

    2

    Your rule decides

    Accepting locks the bond and the guarantor’s money for this order. The contract checks your rule again when you accept.

    3

    Due date

    The order comes due in a few seconds in this demo.

    4

    The company doesn’t repay the guarantor

    It had a recourse period to repay and stay sealed. Until now its agents were frozen but kept their keys.

    How net-30 compares with what you can buy today

    A $10,000 order on net-30 with 7 days of inspection. Writ’s fee comes from the credit model. Prices are published list prices or vendor claims, not quotes.

    OptionCostSeller gets paidIt beats Writ whenWrit beats it when
    Writ$190–363 (model: 1% loss, 60% of stake in use), plus the buyer’s $2,000 bond locked for 37 daysDue date if the buyer pays; day 37 if not
    Non-recourse B2B BNPL$261–350 vendor claim, over 60 daysWithin a day, up to 90–100%You want the cash now. This is the strongest alternative.Stablecoin settlement, machine orders, a seller who can only write a rule
    Corporate card$290 Stripe list priceSoon afterThe buyer already has a cardAgent disputes: “no liability shift exists yet”, and issuers tend to side with the cardholder
    Bank standby L/CNot priced here. Sample clauses show 0.375% a year and margin-based ratesOn presentationLarge orders, and a buyer with a bank line. Probably much cheaper.Small orders; a decision in seconds
    Credit insurance + net-300.05–1% of annual turnover secondary sourceWhen the buyer paysYou insure a whole book of known buyers. Cheapest.A first order from an unknown buyer; stop-ship reaches every seller of that mandate at once
    Escrow or prepayThe buyer’s cost of cashUp front or on releaseYou know the amount, and the buyer has cash. Often the right answer.Usage-priced orders, where the amount is unknown until delivery

    Fire one employee. Every agent under them stops.

    A mandate covers every agent it hires, and a hire can only narrow what it allows. When someone leaves, HR revokes the credential without their help.

    Run it: four steps, each a real transaction
    1

    A poisoned invoice reaches the lowest agent

    Suppose it obeys.

    2

    A fooled agent tries to grant more than it has

    It hires a helper and adds a payee it was never given.

    3

    The employee leaves. HR revokes.

    Anyone holding that signed KERI event can hand it to the contract.

    4

    All three agents try to pay

    Same keys, valid budget links, permitted payee.

    Read who pays for a mandate in one command.

    near contract call-function as-read-only … cover_of json-args '{"cell":"…"}' network-config testnet now

    Integration guide · contract interface · error codes · security policy