Trussted

Warrant — The Trust Layer for Agentic Commerce

Inspiration

AI agents are rapidly evolving from assistants that recommend products into autonomous systems capable of making purchasing decisions. But there's a critical problem: How do we know an AI agent is actually choosing what the user wants, rather than what a malicious website wants it to choose?

Existing safeguards primarily verify an agent's identity, spending limits, and payment permissions. They don't necessarily verify the integrity of the agent's decision.

A manipulated product listing, counterfeit storefront, hidden prompt injection, or carefully crafted merchant metadata can influence an agent into selecting the wrong product while still operating within the user's authorized budget.

We were inspired to explore this overlooked security gap in autonomous commerce and build a layer that evaluates the integrity of an agent's purchasing decision before execution.

What We Built

Introducing Warrant, a decision-integrity and security layer designed to protect AI-powered shopping agents against adversarial manipulation.

Instead of replacing existing shopping agents, Warrant wraps around their selection-and-purchase workflow and independently evaluates their decisions.

Our system introduces six interconnected capabilities:

Decision Integrity Engine: Extracts structured product facts from untrusted storefront content, separates factual information from persuasive language, and performs deterministic product ranking.
Fact Cross-Verification: Cross-checks extracted prices, specifications, and product identifiers against independent reference sources, identifying inconsistencies before a purchase proceeds.
Perturbation & Stability Testing: Removes persuasive content and shuffles candidate ordering to determine whether an agent's preferred product changes under manipulated presentation conditions.
Risk-Based Execution Policy: Produces three deterministic outcomes — ALLOW, STEP_UP, or BLOCK — depending on conflicts, instability, constraint violations, and execution errors.
Cryptographic Evidence Receipt: Creates a tamper-evident, hash-chained audit trail with Ed25519 signatures, recording the user's mandate, observations, extracted facts, conflicts, rankings, and final decision. Receipts can be independently verified offline.
Cart-Bound Credential Simulation: Demonstrates how a single-use signed credential can be bound to a specific cart, merchant, amount, and expiry, with a mock payment gateway rejecting mismatches.

How It Works

Warrant follows a structured security pipeline:

User Intent → Product Extraction → Independent Fact Verification → Deterministic Ranking → Perturbation Testing → Risk Decision → Simulated Credential → Cryptographic Receipt.

A key architectural principle is that the LLM is restricted to the extraction stage. Ranking, policy enforcement, credential verification, and cryptographic signing are handled by deterministic code.

What Makes Warrant Different?

Traditional safeguards focus on whether an agent is authorized to make a purchase. Warrant investigates whether the decision itself is trustworthy.

It doesn't simply ask whether an agent stayed within its budget. It examines whether the product selection was influenced by suspicious content, inconsistent facts, or presentation bias.

We are also building a reproducible benchmark comparing a baseline shopping agent against Warrant across adversarial and benign shopping scenarios, measuring attack success rate, false-block rate, task success, latency, and inference cost.

What We Learned

Building Warrant taught us that securing autonomous AI systems requires more than prompt engineering or spending restrictions. Trust must be enforced throughout the decision and execution pipeline.

We also recognize the limitations: a consistently poisoned fact shared by both reference sources can evade verification, and perturbation testing introduces latency and potential false positives. These are explicit scenarios in our benchmark rather than problems we claim to have completely solved.

What's Next?

Our next steps include expanding the benchmark, evaluating additional attack scenarios, improving reference-source verification, and investigating interoperability with existing agent-commerce protocols.

Warrant's vision is simple: Before an AI agent spends your money, its decision should be independently verifiable.