Cerberus

Inspiration

AI agents can now call APIs, manage wallets, and initiate payments at machine speed. But possession of a signing key only answers “Can this agent pay?” It does not answer “Should this payment be allowed under the institution’s mandate?”

The Monetary Authority of Singapore’s non binding SAFR paper describes a runtime governance pattern for financial agents which encourages the evaluation of proposed actions before execution, routing ambiguous cases to human oversight, and preserving an audit trail.

In Greek mythology, Cerberus guards a boundary that cannot be crossed unchecked. Our Cerberus guards the boundary between an AI agent’s payment intent and financial execution. Its three heads represent the three possible dispositions: ALLOW, DENY, and ESCALATE.

What it does

Cerberus is a pre-execution control plane for AI agents that are capable of executing payments. Before an x402 payment request is created, the agent’s proposed action is evaluated against an active mandate stored in a controls repository.

Based on set rules, the Disposition Engine checks the following:

Permitted action types and currencies
Per transaction and rolling spend limits
Counterparty allowlists
Permitted operating times
Transaction velocity

The engine then returns one deterministic disposition:

ALLOW — the agent may construct and execute the x402 payment.
DENY — execution stops before the payment request is constructed.
ESCALATE — execution is suspended until a human reviewer approves or denies it.

Every proposed action produces an audit record containing the agent, mandate version, disposition, triggered rule, reason, human review, settlement result, and timestamps. Compliance officers can inspect these records through a live dashboard.

The AI model is permitted to generate payment intents only. It never decides whether a transaction is compliant; that decision remains deterministic, explainable, and reproducible.

How we built it

Cerberus is a TypeScript monorepo built with:

Node.js and TypeScript for the agent runtime and services
PostgreSQL 16 for agent identities, mandates, counters, and audit records
Zod for strict SAFR-aligned schema validation
x402 v2 for HTTP-native USDC payments on Base Sepolia
Express for the merchant resource server and audit API
Next.js for the compliance dashboard
viem and Solidity for tamper-evident audit-record hashing and optional on-chain anchoring
Docker Compose for reproducible local infrastructure

The Disposition Engine is a pure evaluate() function with no database, network, clock, or LLM dependency. The agent’s orchestrator loads the applicable mandate and counters, evaluates the proposed action, writes the audit record, and only then constructs the settlement client when execution is permitted.

This placement is fundamental: Cerberus is not a proxy observing payments after they begin. It governs the action before an x402 request exists.

Challenges we ran into

The hardest challenge was proving that a denied transaction was genuinely prevented, not merely attempted and allowed to fail. We added enforcement tests that confirm the x402 settlement client is never constructed on a DENY path and remains unreachable during ESCALATE until human approval.

Audit integrity introduced another challenge. Records change while an action progresses: an escalation gains a human review, and an allowed payment gains a settlement result. We therefore finalize and hash records only after they reach a terminal state.

We also hardened the live review flow against double clicks and concurrent approvals using an atomic database update. Network failures during settlement are captured as terminal failures so audit rows are never left indefinitely in limbo.

Finally, we preserved the exact SAFR terminology and schema structure while keeping the compliance logic deterministic and independent from the AI generating the intent.

Accomplishments that we're proud of

Implemented all three dispositions end to end: ALLOW, DENY, and ESCALATE
Proved that DENY prevents construction of the x402 request
Built live human approval that resumes a suspended agent payment
Created a versioned controls repository with spend, counterparty, time, and velocity controls
Built a compliance dashboard with live audit records, rule explanations, threshold versus actual comparisons, and reviewer actions
Implemented deterministic audit hashing and asynchronous on-chain anchoring support
Passed 91 automated tests, full TypeScript validation, database verification, and a production dashboard build
Reproduced the complete three-scenario demonstration consistently across repeated runs

What we learned

Agent authorization and agent governance are different problems. A wallet permission proves that an agent can sign, but a runtime mandate determines whether a specific action should proceed. We also learned that not every policy breach should have the same outcome. Clear boundary violations should be denied immediately, while uncertain but potentially legitimate actions should be escalated to human judgment. Most importantly, financial governance should not depend on probabilistic model judgment. AI can propose an action, but institutional authority must remain deterministic, explainable, and auditable.

What's next for Cerberus

Next, we plan to add stronger agent identity verification, signed governance envelopes, production authentication for human reviewers, and concurrency controls for multi-agent deployments.

The current prototype implements SAFR’s payments and treasury domain. The same disposition pattern could later govern other SAFR domains, including advisory workflows and controlled client communications.