Coverage
What the seven checks catch, mapped to the OWASP agentic categories, and what they do not. Both columns are the product.
Assurance has five parts. Prevented where provable. Detected when attempted. Bounded when it gets through. Proven afterwards. Insurable because losses are priced.
We are a checkpoint on value and guarded state. We never see the prompt, we do not run the model, and we do not sit on the channel between agents. Where a row below says not covered, that is the honest shape of a checkpoint, and it is why the caps exist: what we cannot prevent we bound.
- ASI01Agent goal hijackpartialwhat detent catches
A hijacked agent that tries to move value to anyone the mandate did not name, or above the cap, is refused. The intent stays in the signed mandate; the agent cannot widen it.
02 mandate scope01 realitywhat it does not catchWe never see the prompt. A hijacked agent that stays inside every limit and pays an allowlisted payee looks like a correct agent, because to the rail it is one.
- ASI02Tool misusecoveredwhat detent catches
Every tool call that can move value or change state gets a verdict and a receipt. A tool used to pay the wrong party, the wrong amount, or too often hits checks 2 and 3.
02 mandate scope03 velocity07 post approval integritywhat it does not catchA tool that reads, summarises or emails and touches no wallet is out of our path. We are a checkpoint on value and state, not on every tool.
- ASI03Identity and privilege abusecoveredwhat detent catches
An unlisted actor, a forged request signature, a replayed nonce, a tampered or untrusted mandate: refused before the envelope is even decoded. An envelope that quietly adds a signer or drops thresholds is refused by the reality check.
02 mandate scope01 realitywhat it does not catchIf an attacker holds the agent's real key and the mandate names that key, we cannot tell them apart at the door. Caps and velocity bound what they can do; identity alone does not stop them.
- ASI04Supply chain and tool compromisepartialwhat detent catches
A tool definition pinned by hash at approval that differs at call time is check 7's failure. A poisoned MCP server that changes a schema after the owner said yes is caught before the call.
07 post approval integritywhat it does not catchA tool that was malicious at approval time pins as itself. A compromised dependency in the agent's own process is not visible to a hash of a tool definition.
- ASI05Unexpected code executionnot coveredwhat detent catches
Nothing directly. If executed code tries to move value it meets the same seven checks as any other caller, and that is the only place we see it.
what it does not catchCode execution that touches no wallet and changes no guarded state is invisible to us. Sandboxing is someone else's product.
- ASI06Memory and context poisoningpartialwhat detent catches
The learning plane's own memory is the thing we defend: it can raise a verdict toward caution, never lower one, and never rewrite a check. A poisoned entry mis-flags one destination at worst.
04 counterparty (as a signed input)what it does not catchWe do not stop an agent from reading a poisoned page, a poisoned memory store or a poisoned retrieval result. We catch what it tries to do with value afterwards.
- ASI07Insecure inter-agent communicationnot coveredwhat detent catches
Nothing on the channel itself. When an agent-to-agent conversation ends in a payment, that payment is judged like any other.
06 rail integrity (transport around a request, not between agents)what it does not catchCross-agent messages we do not sit on. Spoofed, replayed or leaked messages between agents that move no value are out of scope.
- ASI08Cascading failurespartialwhat detent catches
Hard caps and rolling windows bound the blast radius of any single agent. The fleet kill switch sets velocity to zero across an organisation, and its firing is itself a receipt.
03 velocity02 mandate scopewhat it does not catchA cascade that is inside every limit, one small correct-looking payment per agent per window, is bounded by the caps but not stopped by them. Bounding is the promise; prevention here is not.
- ASI09Human-agent trust exploitationcoveredwhat detent catches
A STEP-UP is answered by a passkey signature over the hash of the exact transaction. A voice, a video, an email or a chat message authorises nothing. Change one field and the approval dies.
02 mandate scope (step-up ratio)passkey dynamic linkingwhat it does not catchA human who is talked into approving the right hash with their own finger has approved it. Dynamic linking makes the approval unforgeable, not the human unfoolable.
- ASI10Rogue agentspartialwhat detent catches
A rogue agent is bounded by its mandate and its velocity, refused by the registry when it pays a flagged party, and stopped by the kill switch. Every attempt leaves a receipt, so the rogue leaves evidence.
02 mandate scope03 velocity04 counterpartywhat it does not catchWe do not detect model misbehaviour that moves no value. A rogue that lies, stalls, or leaks text is a different product's problem; a rogue that pays is ours.
- 01 reality · what does this transaction actually do
- 02 mandate scope · is this what the human asked for
- 03 velocity · is this spending pattern sane
- 04 counterparty · is the other side a known bad actor
- 05 privacy · is this payment leaking data
- 06 rail integrity · is the rail itself being gamed
- 07 post approval integrity · has anything changed since you said yes
Deterministic, deny wins, no model in the path. See them run in the playground.