Midnight Mandate

The problem

AI agents are rapidly gaining the ability to act, purchase, and move money, but the safety model around that authority is broken.

Today, teams usually choose between two bad options:

keep spending policies on a private server, where users cannot verify enforcement and a compromised agent or backend can bypass them; or
place the policy in a transparent smart contract, exposing budgets, approved vendors, and operational strategy to the public.

There is also a dangerous gap between what an agent proposes, what a policy checker approves, and what the wallet ultimately sends. A model can hallucinate an amount or recipient, a valid instruction can be replayed, or an off-chain approval can be bypassed by a separate transfer call.

Autonomous commerce needs something better: narrowly delegated authority whose rules remain private, whose enforcement is independently verifiable, and whose protected action cannot happen unless the rules pass.

Inspiration

We entered the AI track because we believe the next generation of agents should receive bounded capabilities—not unrestricted wallet keys.

Midnight immediately stood out as the right foundation. Its combination of Compact, local witnesses, client-side zero-knowledge proving, and hybrid public/private contract state removes the false choice between privacy and enforceability. Midnight does not merely let an application hide a value; it lets that hidden value become the control plane for a real state transition.

That led us to one design requirement:

The proof must not sit beside the payment as an advisory badge. The payment itself must become impossible unless the private mandate is satisfied.

What it does

Midnight Mandate is a contract-custodied test-NIGHT vault for AI-agent payments.

An owner privately configures:

a maximum amount per payment;
a cumulative spending ceiling;
one approved recipient;
a private policy secret; and
a distinct owner-recovery secret.

Only cryptographic commitments and the intended public lifecycle state reach the ledger. The private policy opening remains in local private state.

An AI adapter converts a natural-language instruction such as Pay 5 NIGHT to vendor for invoice INV-42 into a strict typed proposal. The model may suggest only the amount, an allow-listed recipient alias, and a normalized purpose. Deterministic code binds the real address, network, contract, token color, nonce, and request hash, so the model never receives unrestricted transaction authority.

The Compact agent_pay circuit then:

recomputes and verifies the private mandate commitment;
checks the exact amount and precommitted recipient;
enforces both the private per-payment cap and cumulative ceiling;
rejects a reused nullifier;
checks contract custody; and
sends the exact checked amount to the exact checked recipient in the same transaction.

If any condition fails, the entire state transition fails. No payment is made, no receipt is added, and balances remain unchanged.

For every successful payment, the contract also records an exact public request receipt. Our client verifies that the indexed payment_receipts[nullifier] value equals the proposal's request commitment. This makes the result auditable without publishing the private mandate opening.

Why Midnight is essential

Midnight is the reason this product can exist with its strongest guarantee intact.

A normal private backend can conceal a rule but asks the user to trust that it was applied. A normal transparent contract can enforce a rule but reveals it. Midnight's programmable privacy gives us a third option: the network verifies that a hidden rule authorized the transition without receiving the private inputs that define that rule.

We used Midnight's architecture deliberately:

Compact circuits encode the actual authorization boundary.
Private witnesses keep the policy opening off the public ledger.
Public commitments bind the contract to one immutable mandate.
Contract custody prevents the agent from bypassing the authorized payout path.
Atomic transaction semantics couple proof, receipt, ledger mutation, and payment.
The local proof server produces the zero-knowledge proof while keeping witness data on controlled infrastructure.
The indexer and public ledger projection make receipts, lifecycle, and balance movement independently inspectable.

This is what impressed us most about Midnight: privacy is not treated as a cosmetic encryption layer. It is programmable and composable with the action the application cares about.

Our prototype deliberately uses public unshielded settlement, so a successful payment's amount and recipient become public. We do not claim otherwise. The privacy guarantee covers the mandate before and between uses: the private caps, preconfigured recipient opening, and secrets are never returned by the public observer.

How we used AI

The AI component is intentionally powerful enough to improve usability and intentionally too weak to control authority.

Our optional schema-guided AI adapter interprets natural-language payment instructions and returns only three fields: amount, recipient alias, and purpose. The same validated proposal can also be generated through a deterministic adapter for recording reliability.

Everything capable of redirecting or replaying value is controlled by code. The model cannot choose an arbitrary address, network, contract, token color, nonce, or request hash. Unknown fields, malformed output, unapproved aliases, and provider failures all fail closed.

This makes Midnight Mandate an AI guardrail in the strongest sense: the agent proposes intent, while Midnight remains the final authority over whether that intent can become a payment.

How we built it

The system has four layers:

Compact contract: private policy and owner witnesses, public commitments, cumulative spend, replay nullifiers, exact request receipts, contract-held NIGHT, and owner-authenticated recovery.
Midnight client: Midnight.js providers for wallet synchronization, deployment, funding, local proof generation, transaction submission, indexer confirmation, and authoritative balance observation.
Typed AI boundary: strict TypeScript proposal validation plus deterministic and optional live schema-guided extraction paths.
Demo application: a React/Vite command center with owner, agent, adversarial-test, evidence, and isolated public-observer experiences.

The React interface contains no duplicate policy engine. It asks the local demo API to invoke the real Midnight client and displays only indexed or client-verified outcomes.

Challenges we ran into

Making the proof causal

Our first architectural pressure test exposed the central risk: checking a policy locally and then calling a wallet would still allow the transfer to bypass the proof. We solved this by moving custody into the contract and calling sendUnshielded inside the same Compact circuit that verifies the hidden mandate.

Preserving a real privacy boundary

A visually separate observer is not enough if its API payload still contains private fields. We created a dedicated public-only endpoint and tested that the observer payload and DOM contain no owner secret, private caps, remaining private allowance, natural-language instruction, or proposal object.

Protecting cumulative budgets and recovery

A per-payment cap alone still allows an agent to drain a vault through many fresh nonces. We added a privately committed cumulative ceiling. We also discovered that a lifetime ceiling below the deposit could strand funds, so we added a separately committed owner authority that can recover the exact remaining balance and permanently close the vault.

Working across a fast-moving stack

Midnight's stack is powerful and evolving quickly. We had to pin compatible compiler, runtime, Midnight.js, wallet, node, indexer, and proof-server versions; use the correct unshielded keystore and address representation; wait for wallet/indexer synchronization; and turn provider failures into useful, fail-closed application states.

Accomplishments that we're proud of

A real local Compact proof caused a real contract-held payment: vault 50 → 45, vendor +5.
The indexed public receipt exactly matched the successful proposal's request commitment.
All 17 contract tests and 12 proposal-boundary tests pass.
Four judge-visible attacks use the real contract path and reject with zero balance movement: per-payment cap, cumulative budget, wrong recipient, and replay.
The cumulative test is nontrivial: after spending 5, a fresh payment of 8 is below the private per-payment cap of 10 but exceeds the private total of 12.
A distinct owner proof recovered the remaining 45 NIGHT, set the vault balance to zero, and permanently closed the vault.
The public observer exposes commitments, receipts, cumulative public spend, balances, and lifecycle while omitting the private mandate opening.
A one-command smoke test reproduces deployment, proving, payment, attacks, receipt verification, and recovery.
The public CI workflow independently installs the pinned Compact compiler and reruns compilation, tests, builds, dependency audit, and secret scan.

What we learned

The most important lesson was that zero-knowledge proofs are not only privacy-preserving attestations; on Midnight, they can become authorization mechanisms.

We came into the hackathon thinking mainly about hiding sensitive values. We left understanding a much more powerful pattern: a private fact or policy can govern a public action without becoming public itself. That is a fundamentally better trust model for finance, identity, compliance, and autonomous software.

Midnight also pushed us to be precise about claim boundaries. A proof establishes the circuit's predicate over its bound inputs; it does not magically prove an off-chain fact or an LLM's reasoning. Designing around that boundary made both our AI layer and our contract safer.

What's next

Midnight Mandate can grow into a reusable private-capability layer for the agent economy.

The next contract version would add:

epoch or daily budgets instead of one lifetime ceiling;
expiry and revocation;
private merchant-set membership instead of one fixed recipient;
policy and owner-key rotation with guardians or multisig;
selective audit proofs for finance and compliance teams;
sponsored DUST so agents can operate without holding a volatile gas asset;
shielded outgoing settlement when both policy and payment privacy are required; and
cross-chain consumption of a Midnight authorization through VIA.

The long-term use cases include enterprise procurement agents, delegated treasury operations, DAO spending, automated expense management, DeFi rebalancing, commerce agents, and any workflow where software needs useful authority without receiving unlimited authority.

Midnight is especially well positioned for this future. As agents become economic actors, the internet will need a private, programmable trust layer that can answer: Was this exact action inside the authority the user granted? Midnight Mandate is our first working answer.