IntentGuard

"An AI treasury agent that decides, but never controls the money the chain does."

Comment

Inspiration

Every serious attempt to give an AI agent control over money runs into the same unsolved problem: the agent's safety rules live in its own code. A refusal is just an if statement, and an if statement is exactly the thing a compromised, buggy, or prompt-injected agent will simply not execute. Every "trust our AI" guarantee in DeFi today rests on that fragile foundation including most of the AI-agent projects being built right now. IntentGuard starts from the opposite premise: an agent's authority to move money should be bounded by something it cannot itself override.

What it does

The system works by refusing to let the AI touch execution at all. A user states a treasury objective in plain language move a fixed amount to the best risk-adjusted opportunity, within explicit limits on fee and risk tolerance. IntentGuard converts that into a standardized ERC-7683 cross-chain intent and puts it out to a network of solvers, who compete on price and speed. Every quote that comes back is treated as a claim, not a fact which matters, because a solver's own metadata is attacker-controlled input, and a naive agent that reads it directly is trivially prompt-injectable by the very counterparty it's evaluating.

That's why evaluation isn't a single model scoring a spreadsheet. IntentGuard runs two AI agents, drawn from different underlying model families, arguing from opposing incentives one making the case for a route, the other rewarded specifically for finding the reason to reject it, including screening for injected instructions in solver data. A third agent weighs both arguments and rules. Before anything is signed, the winning route is replayed against a forked copy of live chain state, so a route that looks optimal on every declared field best price, lowest fee, clean risk tier but has an undisclosed transfer restriction on the destination token gets caught by simulation, not discovered after the funds are gone. Every risk figure the system produces traces back to a queryable source: on-chain reads of contract upgradeability and admin control, liquidity and incident data, and live off-chain signal on exploits and market sentiment nothing is an asserted opinion about a named third party.

The decision the AI reaches still isn't the last word. It's submitted to an on-chain policy vault that independently re-checks it against the user's committed constraints and reverts anything out of bounds a guarantee that holds even if the agent upstream is fully compromised. That's the moment the pitch is built around: forcing a policy-violating route through by bypassing the AI entirely, and watching the smart contract refuse it anyway. Judges see AI-makes-a-good-decision demos constantly. They rarely see a team attack their own system live and watch it hold and that single moment is what turns an interesting concept into a proven one on stage.

How we built it

The Policy Vault is a Solidity contract enforcing max risk tier, max fee, per-transaction and daily notional budgets, and an allowed-settlers merkle root, deployed to a testnet (Base Sepolia / Arbitrum Sepolia) and critically, that daily budget covers both trade size and the agent's own AISA evidence spend, not just the trade itself. Feeding it is an evidence-grounded risk oracle: live RPC reads against EIP-1967 implementation and admin storage slots for upgradeability and timelock detection, DefiLlama for TVL, TVL trend, and incident history, and AISA's unified API for exploit-report search, peg quotes, prediction-market odds, and social and governance signal one key standing in for what would otherwise be five separate vendor integrations.

Evaluation runs through a cross-model adversarial review pipeline Proposer, Red Team, and Arbiter, deliberately routed to different model families through the AISA gateway rather than three prompts run against one model with explicit prompt-injection screening on any solver-supplied metadata before it reaches the Arbiter's context. Every one of those AISA calls is a real, priced, machine-to-machine payment settled through x402, so the agent's information-gathering cost is a visible, governable line item rather than a flat-rate subscription nobody is watching. Before a route is ever signed, an Anvil mainnet fork actually executes it and asserts real balance deltas, honeypot behavior, and approval scope, rather than trusting the solver's quote at face value. The solver layer itself is mocked for the prototype three simulated solvers since the real engineering bet here is the decision and enforcement layers, not rebuilding bridge infrastructure from scratch in a weekend.

Challenges we ran into

Making the trust boundary honest, not just impressive, took real thought. The attestor that signs risk attestations for the vault is currently a single EOA a real, acknowledged weak point and rather than paper over it, we scoped the production path, an m-of-n attestor committee or a TEE with remote attestation, and decided to say so out loud in the pitch instead of waiting for a judge to find it. Treating solver data as hostile input was harder than it sounds: getting the Red Team to screen for instruction-shaped content in solver metadata, without that untrusted metadata leaking into the Arbiter's context as if it were a trusted instruction, took more care than a simple keyword filter would suggest. And metering spend without breaking the demo's autonomy story turned out to be its own puzzle bringing x402 evidence-spend inside the vault's daily budget meant the agent now has two things it can exhaust, trade notional and data spend, and both had to stay visible in the same decision journal without the whole thing turning into a ledger dump.

Accomplishments that we're proud of

We're proud that the policy vault reverts a forged, policy-violating order on-chain even when the AI agent is bypassed entirely the guarantee lives in the contract, not in the agent's judgment, which was the whole point of building this the way we did. We're proud that every risk signal the system produces, whether it comes from live chain state or live off-chain evidence like exploit reports, peg quotes, or prediction-market odds, is clickable back to its source, with no editorial risk tiers asserted about named third parties. And we're proud of the adversarial review loop itself: two different model families genuinely disagreeing about real money, with the dissent preserved in the decision journal rather than smoothed over.

What we learned

The clearest lesson was that "evidence-grounded" and "AI-powered" pull in opposite directions unless you're deliberate about it. It's easy to have a model assert "this bridge is medium risk" and have that sound authoritative but an unsourced verdict about a named third party is a liability, not a feature, the moment a judge asks "how do you know that." Rebuilding the risk oracle around sourced, clickable facts instead of editorial tiers changed how we thought about what the AI's job actually is: not to produce a verdict, but to reason about what a set of verified facts implies.

The second was that "multi-agent" is not automatically more trustworthy than single-agent it's only more trustworthy if the agents are genuinely adversarial and the untrusted data between them is treated as untrusted. A Red Team agent that reads solver metadata the same way it reads its own instructions is a Red Team agent that can be talked out of its own job by whoever it's supposed to be scrutinizing. That reframing solver data as attacker-controlled input, not just noisy input ended up shaping more of the architecture than any single feature did.

What's next for IntentGuard

What makes this more than a hackathon trick is that the enforcement scales to something an organization would actually pay for. The same vault that bounds a single trade also bounds the agent's own operating costs every piece of evidence it pulls is a metered, per-call payment charged against the identical on-chain budget, so an autonomous agent's second, quieter attack surface, unbounded spending on its own behalf, is closed by the same mechanism as the first. Positions stay under continuous review after execution, not just at the moment of the trade, so a contract upgrade or a liquidity collapse days later triggers escalation instead of silence. That's the difference between a one-shot demo and a standing mandate a company could actually delegate the answer to "what is this in two years" is a policy enforcement layer for autonomous treasury operations, with a full audit trail of every decision the agent made and every one it refused to make.

Concretely, that means moving the attestor from a single EOA to an m-of-n threshold committee, or a TEE with remote attestation, for production-grade trust; replacing mocked solver quotes with real ERC-7683 solver integrations like Across, UniswapX, and Eco; extending drift monitoring from a handful of demo signals to full continuous re-scoring of every open position; and adding roles and multi-sig approval flows, treasury ops proposing and CFO approving above a threshold, so the mandate maps onto how a real organization actually delegates authority.

Built With

Share this project:

Updates