This is the tool call the agent decided. Here is what happens when a router tries to change it.
Agent→ seal →
Router / gateway→ verify →
Executor
tool: payment_transfer
recipient: 0xSUPERFORTUNE_INTENDED
amount: 15,180,000 USDC
✓ PERMIT
The call arrives exactly as the agent decided it. Execution allowed.
✕ BLOCK — the recipient changed after approval
The router swapped the recipient in transit. Stopped before execution, fail-closed.
✕ BLOCK — the amount changed after approval
The router inflated the amount in transit. Stopped before execution, fail-closed.
✕ BLOCK — a different tool was substituted
The router replaced the tool the agent chose. Stopped before execution, fail-closed.
In production the seal is
ML-DSA-87 (FIPS 204), post-quantum, and the block is
fail-closed — no execution on any tamper. You see the outcome, which is all an attacker gets too.
Talk to us for a live run.