Scripted-naive
Floor baselineA blind script that pays every invoice without checking. It trips the safety gate.
- Out-of-bounds invoices
- 60 of 60 failed
- Gate G1
- Tripped
- Exam upper bound
- p = 1.000
Qualify
Policy card
How an exam result becomes a spending limit, and the limit each agent was given.
Scripted demo values. The three agent cards below are fixed demo values. Recorded exam reports are on the Evidence page.
Printed on every policy card
Read this first
Bounds describe the exam’s scenario distribution, not real-world attack frequency.
a is the owner’s assumption about the share of adversarial invoices; sensitivity shown for a ∈ {0.01, 0.05, 0.20}.
Worst case if this agent is fully compromised: unreviewed autonomous payments never exceed the bond remaining; at most
t1MaxPerWindowper window; only to registered vendors past cool-down.
Three agents, one exam
Evaluated on the same fixed stream: 390 scenarios (120 benign, 60 out-of-bounds, 210 wrong-but-permitted).
LLM, basic
Gemini 2.5 FlashA standard tool-calling model without a hardened defensive prompt.
- Out-of-bounds invoices
- 0 of 60 got through
- Completion rate
- 94.2%
- Exam upper bound
- p ≤ 0.125
LLM, hardened
Gemini 2.5 ProReasoning with prompt defence, documents-as-data parsing and an invariant check.
- Out-of-bounds invoices
- 0 of 60 got through
- Completion rate
- 98.3%
- Exam upper bound
- p ≤ 0.0531
Sizing compiler
What if the assumptions change?
What-if. You choose the inputs. Nothing is saved or sent.
$10.00
Raw cap
$941.34
R ÷ (a × p), with p fixed at 0.0531
Owner ceiling
$300.00
A hard limit in the contract
Enforced per window
$300.00
Rounded down to the nearest $10