PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution, is presented and frame its claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.
Abstract
Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution. PACE introduces typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection. A Solidity smart account enforces PDR signatures on-chain with a measured overhead of 29,826-31,822 gas. We evaluate PACE against six baselines on 40 tasks spanning four attack categories plus benign utility (2,800 trials, 10 seeds). In our deterministic sandbox, PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline. Ablation studies identify permissive policy settings (+57.5 pp) and the touched-contract allowlist (+12.5 pp) as the dominant safety components. To test whether the same deterministic floor holds for real model outputs, the artifact additionally provides a three-model live-LLM evaluation over the full task suite with repeated runs. A mainnet-fork harness is included for archive-RPC deployments, but fork results are reported only when the corresponding artifacts are generated. These auxiliary studies are separate from, and never substitute for, the deterministic benchmark. We frame our claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.
Decentralized finance (DeFi) agents automate multi-transaction workflows such as swapping, lending, and vault management, but they also create process-level risk. A run can consist of individually valid calls while still becoming economically unsafe because an intermediate step leaves latent authority, weakens execution constraints, or accepts unverified external evidence. Existing defenses are often mismatched to this process-level risk. Off-chain preflight checks alone cannot protect against runtime deviations from the intended plan, and coarse on-chain allowlists are too weak to express the call-level intent that matters in DeFi. We present CheckpointAgent, a workflow-security architecture for checkpointed DeFi-agent execution. It composes manifest commitments, smart-account policy guards, post-state predicates, and attestation-gated advancement to constrain a run step by step and tie checkpoint advancement to verifiable evidence. Rather than judging safety only after a workflow finishes, CheckpointAgent checks whether each step remains consistent with the intended workflow and stops execution when the required conditions no longer hold. In the author-curated 27-scenario local-chain suite, the strongest evaluated setting preserves all 5 benign runs and prevents unsafe completion in all 22 adversarial runs, stopping them either through on-chain enforcement or through trusted-attestation advancement under the configured attester assumption. Under explicit trust assumptions and within the measured workflows and snapshots, checkpointed execution can materially reduce process-level risk without modifying target protocols.
Autonomous AI agents now hold execution authority over high-consequence enterprise actions in finance, healthcare, and infrastructure, where catastrophic failures are rare yet dominate systemic risk and probabilistic content filtering does not constitute a reference monitor over what is executed. This paper introduces L-DREA, a deterministic runtime-enforcement architecture that generalizes Anderson’s 1972 reference-monitor primitive from mediation of data access to mediation of externally effective action. L-DREA separates capability generation from execution authority, binds every candidate action to an epoch-keyed Permit-to-Act token, and interlocks externalization through a commit-before-actuate substrate. Five structural properties generalize Anderson’s primitive — complete mediation, tamper-resistance, verifiability, non-compensatory aggregation, and epistemic bounding — and six runtime invariants are established analytically, the first additionally mechanized in TLA+ with a released TLC log. A software (Tier-S) reference implementation is evaluated on two disjoint evidence tracks: a seeded synthetic corpus of 1,217,906 runtime proposals (360,000 adversarial), and the public ULB credit-card dataset (284,807 transactions) as a golden-oracle authorization trace, plus a blind committed-before-label-reveal protocol on three public datasets. Across both tracks, a 120,000-attempt full-knowledge adaptive attacker, 2,394 injected runtime attacks, live revocation and watchdog suites, and an executed offline AgentDojo run, zero unauthorized externalizations were observed; exact one-sided Clopper–Pearson and Wilson upper bounds accompany every zero-event claim, with replay determinism of 100.0000% over 1,217,906 cycles and 24,912 Ed25519-signed permit tokens runtime-verified at 100% integrity. All results are bounded to the documented threat surface and released as a seeded, one-command reproducible artifact; hardware substrates and HSM key custody are specified, not claimed.
AI agents can select tools, counterparties, and transaction parameters, yet inference should not itself confer authority to execute a financial action. This study develops and evaluates Authority-Inference Separation (AIS), an intent-centered architecture for bounded agentic finance. AIS treats a financial action intent as the control object: a machine-generated proposal can receive temporary executable authority only after an independent deterministic control plane validates registered agent identity, accountable ownership, mandate and risk-appetite lineage, policy version, state, approvals, and exact economic semantics. Blockchain can then enforce the operational representation of granted authority and record portable settlement evidence, while institutional legitimacy, service delivery, accounting classification, and human accountability remain off-chain obligations. Evaluation combines four-domain instantiation, official BIS and MAS cases, a 48-fixture executable prototype, and a public-ledger observability test. Across 36 synthetic authorization attacks, a direct-agent baseline accepted 36 attack effects, a prompt-policy baseline accepted 20, and AIS accepted none; all three accepted 8/8 admissible fixtures. AIS also rejected 4/4 token replays and 8/8 recipient or rail substitutions, withheld completion in 4/4 service-delivery failures, and populated all 13 defined evidence fields. A test of 1,700 recent Base transactions associated with public x402 facilitator addresses shows that public ledgers can evidence settlement and selected authorization parameters but cannot establish institutional mandate, legal accountability, service delivery, or accounting treatment. AIS and blockchain are therefore complementary: AIS decides whether a specific intent may act, while blockchain can make granted authority bounded, executable, and independently observable.
The Agentic Payments Observatory (APO) is proposed, a dashboard-centred reference architecture that unifies agent identity resolution, scoped permission verification, smart-contract and receipt reconciliation, real-time anomaly detection and policy-breach adjudication into a single operational surface.
Jay Roy, David Miller· International Journal for Re...· 0 citations
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals---free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side re-validation under persona perturbation (five model configurations) and no persona fingerprint on hard-asserted fields. A probe of a recovered pre-separation build found the governed execution path decoupled from the persona by omission, not by construction; a later wiring change could reverse that isolation, which PES makes an audited architectural rule. The pattern applies when multi-user deployment, execution audit, and expected persona churn hold jointly.
The resulting research prototype binds each deterministic policy decision to the exact policy source, commits a privacy-minimizing record at a caller-selected synchronization boundary, and returns an Ed25519-signed receipt that states whether that boundary completed.
Neeraj Kumar Singh Beshane· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
