How a request is judged: signature, role permission, duplicate reuse and budget. Any failed check stops the request..
Control Tower: see enrolled agents and their verified addresses, run an AI-planned task, and watch every access decision live.
AgentCircuit: a control layer between AI agents and sensitive resources. The AI plans; AgentCircuit authorizes.
Interactive Demo: write a goal, pick an AI model and CRS persona, and run. The AI decides which agent acts next.
Live Oversight: counts of AI decisions, messages, cache reuses and blocks, plus the latest AI choice and its verdict.
Left: live agent logs of each security check. Right: timeline of agent messages, AI routing and access outcomes.

Inspiration

Companies are moving from one assistant to fleets of agents: one checks credit, one looks for fraud, one handles payments. Each agent is smart on its own, but none of them knows what the others are doing.

In finance that gap is expensive and risky. Three agents can pull the same credit report three times. Two agents can jointly blow through a budget neither would exceed alone. A payment agent can be talked into reading a credit file it has no business seeing. Orchestration frameworks route work between agents, but they rarely enforce who may touch what. We wanted a referee that every agent has to go through, no matter which model is driving it.

What it does

AgentCircuit runs a simulated lending team of three Fetch.ai agents (Credit, Fraud and Payment) against the CRS credit-bureau sandbox, and controls every request they make.

• Verified identity. Each agent signs its HTTP request with its uAgent secp256k1 key. AgentCircuit checks the signature, timestamp and nonce, then looks up the agent's role in its own registry. A role claimed in the request body is never trusted.

• Permission control. Credit and Fraud may read credit reports. Payment may not, so its attempt is blocked and logged.

• Task deduplication. Pulls are keyed by persona and bureau. A repeat request reuses the cached result, and a concurrent one joins the pull already in flight, so three requests cost one CRS call.

• Budget control. Each pull reserves its cost before the call starts. Concurrent agents cannot jointly overshoot the budget, and a failed pull refunds its reservation.

• Underwriting policy. Rules across TransUnion, Equifax and Experian (deceased flags, security freezes, scores below 660, bureaus disagreeing by more than 50 points) return APPROVE, REVIEW or DECLINE with every reason listed.

• x402 spending guard. Before an agent pays for an x402 API, AgentCircuit reads the HTTP 402 challenge and checks network (Base Sepolia), recipient and price against the agent's limit. It runs as a dry run and never signs a payment.

• AI routing, not AI authority. Gemini or a local Ollama model reads the user's goal and picks the next agent and task from a fixed allowlist. The model decides what to try; AgentCircuit decides what is allowed.

• Control Tower dashboard. A live view of agents, messages, ALLOW / REUSE / BLOCK decisions, budget and AI choices, with a one-click run.

Demo run: Credit requests the P01 TransUnion report and AgentCircuit allows the CRS pull. The AI routes to Fraud, whose identical request is reused from cache. The AI then routes to Payment, whose attempt to read the report is blocked.

How we built it

Payment's credit request stops at check 2. Its x402 call never passes through a wallet: the 402 offer is read and checked against policy, then dropped.

• Agents: three Fetch.ai uAgents run in one Bureau and talk through typed WorkOrder / WorkResult messages. Each agent only accepts messages from the expected sender address.

• Signed requests: each agent signs a canonical string (version, method, path, timestamp, nonce, SHA-256 of the body) with its uAgent key. The server verifies it in Node with our own bech32 decoder and secp256k1 check, with a 2-minute clock-skew limit and nonce replay protection.

• Control layer: Next.js 16 API routes in TypeScript hold the agent registry, permission table, result cache, in-flight map and budget. The dedupe check and budget reservation run synchronously before the first await, which keeps them atomic.

• CRS: a server-side client calls the CRS sandbox bureau endpoints with test personas only. Agents get a summary (status, scores, error codes, request ID), never the raw credit file.

• AI planner: Gemini with a JSON response schema, or Ollama locally, returns next_agent, task and reason. Output is validated against the allowlist, and only planning calls retry on Gemini 503s.

• x402: a paid route built with the official x402 packages on Base Sepolia returns a real 402 PAYMENT-REQUIRED challenge for a synthetic report. The Payment agent decodes it and applies the spending policy.

• Dashboard: a React Control Tower polls the activity, state and AI-plan APIs.

Challenges we ran into

• Verifying uAgent signatures outside Python. uAgents signatures are bech32 strings of about 113 characters, past the usual 90-character limit, so off-the-shelf decoders rejected them. We wrote our own decoder and rebuilt the secp256k1 public key from the agent address.

• Race conditions. Two agents asking for the same report at the same moment could both pay for it. We moved the cache check, in-flight check and budget reservation into one synchronous block.

• Keeping the AI honest about intent. Early routing reacted to keywords. "Do not use x402" still triggered x402. We rewrote the planner prompt and added a code-level check so negation is respected and ambiguous goals end in finish.

• Gemini reliability. We hit HTTP 503 overloads and schema incompatibilities during development. We added bounded retries for planning calls only, with an explicit switch to local Ollama instead of a silent fallback.

• Testing payments without spending money. We needed a real x402 challenge but no real settlement, so the Payment agent inspects the 402 response and enforces policy without ever signing.

Accomplishments that we're proud of

• Identity is enforced cryptographically. An agent cannot get credit data by claiming a different role, because the role comes from its signed address.

• Three agents asking for one report cost one real CRS call, even when the requests arrive at the same time.

• The AI can be swapped between Gemini and a local Ollama model without changing a single permission. The model never grants access.

• A real x402 402 challenge is parsed and checked against a spending limit end to end, with zero risk of an accidental payment.

• Every decision on the dashboard (ALLOW, REUSE, BLOCK, AI choice) comes from a verified event, not a UI guess.

What we learned

• Let the LLM plan, but let deterministic code authorize. Safety rules belong in code the model cannot argue with.

• Multi-agent bugs are concurrency bugs. Deduplication and budgets only hold if the check and the reservation happen atomically.

• Agent identity is the foundation of everything else. Permissions mean nothing if any process can claim to be the Credit agent.

• Agents should get the minimum data they need. Returning a summary instead of the raw CRS file shrank what any one agent could leak.

What's next for AgentCircuit

• Conflict detection and escalation: pause automatic approval when agents reach opposing decisions, and route the case to a human reviewer.

• Failure recovery: reassign a task to another qualified agent when one fails or times out.

• Persistent, deployable store: move the cache, registry, nonces and budget from memory to a database with row locks, and open the routes beyond local development.

• Real x402 settlement: a user-controlled wallet with per-agent spending caps, approved by the same policy engine.

• A general platform: an SDK so any agent framework can route through AgentCircuit, with finance as the first use case.