Wardstone AP2: Zero-Trust Agent Fleet Gatekeeper

Inspiration

In the agentic era, autonomous AI agents are moving beyond simple chat prompts: they are forming decentralized teams, executing complex workflows in the background, and hiring sub-agents using Google and Coinbase's new Agent Payment Protocol (AP2) and on-chain settlement rails.

However, as more agents operate unsupervised, enterprise engineering leads and financial controllers face a terrifying friction: Unsupervised Spend Loops & Runaway Blast Radius. An unhandled prompt loop, rogue tool chain, or sybil attack can burn hundreds of dollars in automated micropayments within minutes before a human even opens a dashboard. We were inspired to build an active immune system for this exact problem.

What it does

Wardstone AP2 is a predictive, zero-trust circuit breaker for the AI Agent Fleet Controller. It intercepts payment mandates before settlement.

1. Predictive Blast-Radius Forecasting: Rather than enforcing static caps, the Forecaster Agent models moving-window velocity based on historical baselines to assign a dynamic 0-100 risk score.
2. Cross-Agent Collusion Detection: It actively monitors a destination burst tracker. If multiple distinct agents attempt to sybil-attack or smurf funds into a single target wallet, the system catches the collusion and floors the risk score.
3. Active Circuit Breaker & Real Testnet Settlement: Safe mandates (< 60 risk) settle instantly on the Ethereum Sepolia testnet, producing verifiable on-chain transaction hashes. Anomalous mandates (>= 60 risk) are quarantined instantly with provably zero on-chain token movement.
4. Gemini 3.5 Flash Institutional Memory: When a mandate is held, the Forensics Agent prompts Gemini 3.5 Flash to generate a plain-English incident postmortem. Crucially, it queries past human overrides (FORCE_APPROVE), allowing the LLM to natively learn from past fleet controller actions.
5. Policy Simulation Engine: A "what-if" simulation mode allowing controllers to backtest hypothetical new thresholds against historical mandates before deploying them.

How we built it

• Agent Architecture: 4 Google ADK agents (Watcher, Forecaster, Gatekeeper, Forensics) orchestrated under the Multi-Agent Nexus pattern with strict separation of concerns.
• Core LLM: Google Gemini 3.5 Flash via the Google GenAI SDK.
• State & Memory: Google Cloud Firestore (mandates, agent_profiles, incidents, overrides).
• Ingestion: Google Cloud Pub/Sub (mandate-events).
• Settlement Rail: Web3 on Ethereum Sepolia Testnet (Chain ID: 11155111) using the official AP2 facilitator flow.
• Frontend & Compute: A responsive Next.js command console deployed on Vercel, securely proxying to a containerized Python backend running on Google Cloud Run.

Challenges we ran into

Building a sub-4ms circuit breaker that intercepts Web3 transactions requires extreme latency optimization. We had to ensure that the Gatekeeper Agent could evaluate the Forecaster's risk score and trip the kill-switch before the transaction was broadcast to the Ethereum Sepolia mempool. Additionally, handling state sync across asynchronously failing agents forced us to implement robust exponential backoffs and defensive fallbacks in the Root Orchestrator.

Accomplishments that we're proud of

We are incredibly proud of successfully bridging Web2 AI infrastructure (Google ADK, Gemini 3.5) with Web3 settlement (Ethereum) in a genuinely zero-trust manner. We're also proud of the Institutional Memory Feedback Loop—seeing Gemini 3.5 natively ingest past human override decisions and adjust its future incident explanations dynamically felt like a massive leap forward in agentic governance.

What we learned

1. Active Gating > Passive Observability: You cannot rely on post-execution dashboards when autonomous agents have real wallets. Control planes must act as pre-settlement immune systems.
2. Collaborative Governance: Exposing pre-clearance query RPCs via JSON-LD allows well-behaved agents to verify their spend headroom before committing expensive transactions.

What's next for Wardstone AP2: Zero-Trust Agent Fleet Gatekeeper

Moving forward, we plan to graduate Wardstone from Ethereum Sepolia testnet to mainnet deployment. We also want to expand the A2A (Agent-to-Agent) Identity Card protocol, allowing external agents to post verifiable collateral bonds to Wardstone before they are allowed to operate within the enterprise fleet.

Built With

• ethereum-sepolia
• fastapi
• gemini-3.5-flash
• google-adk
• google-cloud-firestore
• google-cloud-pubsub
• google-cloud-run
• next.js
• python
• typescript
• vercel