You delegate a task to an agent. It books, buys, cancels and writes on your behalf. WARRANT is the limit you set in one plain sentence — enforced before the action, proved afterwards. Under a fifth of ordinary actions ever interrupt you. The rest run silently, on record.
A public attack corpus: 4,371 conversations against a bank-teller agent holding a transfer tool, five levels, each with its own ceiling and approved recipients. We replayed every transfer the attacker was after, 2,812 of them, through WARRANT. Two mandates, two columns.
The difference between the two columns is one object: a human who signs the action in three seconds, and a receipt that proves it. The corpus holds attacks only, so it yields no false-deny rate; ours is measured elsewhere on this page (0 of 9,000). Method and numbers: the measured record of 14 October 2026, on request.
Four steps, none of them yours to configure. The product is the interruption budget: if it asked you about everything, you would switch it off — so it asks only when it must.
Before acting, the agent states what it is about to do: what, how much, reversible or not, who is affected. Nothing has happened yet.
Against your sentence. Silent for the ordinary, told afterwards for the material-but-reversible, asks you for the consequential, refuses what is outside the mandate.
One screen, two buttons, a countdown. No answer is a refusal. Stopping is always as easy as approving — where it matters, easier. WARRANT fails closed by construction: a timeout, an unknown tool or a value it cannot read is a refusal, never a pass.
Your approval binds the exact parameters you saw. Different price, merchant or terms at execution → refused. Every step is signed into a record you own.
On 29 September 2026 a central-bank governor told a global payments conference that in agent-delegated commerce the authentication question “shifts from proving that a buyer is an authorized payer” to “proving that an agent has the authority to pay on the buyer’s behalf” — and asked: “Who is on the hook if an agent makes the wrong purchase?” Three barriers to scale — authentication, liability, fraud — and no artefact named for any of them. For superintelligent AI agents that shop and pay for people, those two sentences are the problem statement. WARRANT answers barrier by barrier.
The WARRANT mandate. Authority is a signed object the agent carries — this merchant class, this amount, this day — not a login it borrowed. A storefront, an issuer or an auditor proves the agent’s authority from the mandate and the receipt, with no call to us.
The WARRANT receipt and the signed NOT-DONE. Every action closes with a signed record of what was authorised, what ran and what was refused. The wrong purchase has a receipt that shows who signed for it — or a NOT-DONE that shows it never ran. Fraud, the third barrier, meets bound parameters: a different price, merchant or terms at execution is a refusal. The measured reason the NOT-DONE must be a signed object and not a sentence from the agent: after a tool fails, agents claim false success 22.8% of the time; told to be transparent, 9.3%; under a structured evidence contract, 0.8% (3,600 human-annotated responses, arXiv 2609.35732). The receipt is that contract.
Source: official transcript of the speech, 29 September 2026. The governor’s two sentences are quoted verbatim.
In September 2026 the world's largest online store blocked a consumer agent with 2.5 million downloads in its first two weeks. Its stated reasons: the agent “doesn't identify itself when it browses” and “captures and stores customer credentials”. Its stated rule: agents that buy on behalf of customers “should operate openly”.
Identify yourself. Carry the owner's permission. Prove it at the door. No object existed to check — so the store enforced it with a popup. Every consumer agent at every store that has not signed a bilateral deal breaks the same way.
Sources: Amazon spokesperson statement as quoted by GeekWire and Mashable, 21 September 2026; Bloomberg download count, 21 September 2026; Ars Technica security disclosure, 20 September 2026.
A receipt anyone can verify with nothing but the receipt — the storefront, the issuer, the consumer, an insurer, an auditor. No account, no key, no issuer API. It names the agent, states whether that agent holds your credential, carries the exact parameters you approved, and is post-quantum signed. Every action is closed by a signed DONE or NOT-DONE. POST /warrant/v1/verify — open to any merchant today.
The consumer who delegates errands, the team that runs agents at work, the platform that ships agents to Europe.
The seat, the shirt, the washing machine — delegated, within the limit you set. The friend who kept her agent did not get a better agent. She gave it a WARRANT mandate.
Four things delegated. Two ran silently, one was told afterwards, the €78 shirt was stopped at the price — and when the agent wanted to reset a password to get into the shop, Harry was asked, and said no. He can prove all of it.
Programmes get cancelled when nobody can show oversight. WARRANT is the evidence in the room: the rate, the decisions, the record.
You keep the skin — the brand, the channel, the agent. WARRANT is the spine: every action declared, bound and recorded, so the product you ship can be sold in Europe.
The questions the market asked in September 2026, in its own words, and the one object that answers each of them for every action of a superintelligent AI agent.
Of 214 top-level comments on one incident thread, 62 asked a version of that question; the word “receipt” did not appear once. The answer is an object, not a search: the receipt names the action, the mandate it was checked against, the agent that proposed it and the human whose sentence authorised it — signed before the action ran, verifiable by anyone with nothing but the receipt.
A login says who. A payment says how. The industry calls those two solved and names three gaps after them: shared passwords, the handshake, authentication. Nothing on that list says within what. The mandate says within what, and the receipt proves it. Four lines, and the fourth is ours.
A government said humans are responsible when an agent errs, not the AI. In the same week an incident ended with no logs released on either side and a kill that took hours. Responsibility without a record is a liability with no defence. The signed per-action record is the liability instrument: what was authorised, what ran, what was refused, what was NOT-DONE, each one signed.
A vendor's audit log belongs to the vendor: fields have been blanked after the fact, an agent's acts filed under the human's name, the contact record visible to the administrator alone. A receipt is signed outside the agent's process and outside the vendor's log; rewriting one breaks its signature, and the human holds it.
The largest online store blocked an agent for two stated reasons: it did not identify itself, and it stored customers' credentials. The receipt carries the agent's identity and states whether that agent holds your credential — so a store can let a declared agent in, and a revocation has an object.
The new org chart is one responsible person, twenty agents and three colleagues; the line heard from the stage was “AI can't be accountable”. Correct — so the accountable person needs an instrument. WARRANT is how you sign for them: one mandate per agent, one receipt per action, one export when someone asks.
Every declared action — the silent ones too — chained and signed per person. “212 things ran within your mandate this month” is a verifiable statement, not a claim. Two years of retention.
Every checkpoint with the human’s decision and time-to-decide, the interrupt rate against the budget, and the automation-bias measure that Article 14(4)(b) asks for. One export, ready for an auditor or a consultant.
A hyperscaler's agent runtime now fires four events around a tool call and lets your code return allow or deny, synchronously, for a fraction of a cent per decision. Its own documentation says the hook does not attest to what ran. WARRANT is that hook with a receipt: before the tool call the mandate decides, after it a signed record says what was authorised, what ran, and what was NOT-DONE. Same vocabulary, one more line.
Across a year of one widely followed show, three of its four hosts said, in their own words, that they would not hand an agent their card, their house or their money. In seventeen thousand words of that conversation the word “mandate” did not appear once. They refused custody; nobody offered them a mandate. That is the object they were asking for.
On stage, an agent was told to buy the week's groceries; it asked “which house?” and “which card?”, then executed. Same scene under WARRANT: the mandate already says which house, which card, how much and until when; the agent proposes the basket; the signature either falls inside the limit or it does not; the human holds a receipt either way. The two questions the agent asked are the two fields the mandate had answered before it started.
A terms-of-service clause is accepted once, for everything, forever. A mandate is given per action: this merchant, this amount, this day. WARRANT replaces the blanket with the sentence you actually meant — and signs, per action, that the agent stayed inside it.
The layer that says yes or no to a purchase must not earn more when the answer is yes. We are paid for the check, never a share of what it lets through. In one publication’s hands-on test of a newly launched consumer agent, 0 of 3 everyday errands completed — the cut had been announced before the checkout worked.
Source: PYMNTS hands-on test, 9 September 2026 (three errands tested; none of the three transactions completed).
Between 28 September and 15 October 2026 the market shipped approval cards, decision models, spend caps, audit layers and a swarm’s own message board. Each is a piece of the object superintelligent AI agents need; none is the object. Nine lines, each from a public primary source, each answered.
Four personal-agent products converged on one vocabulary in a week — a rulebook, an ask-first rule and an “Always allow” that writes a standing rule. Zero of them export a verifiable artefact. A card that says “Always allow” writes a rule about every future action. A WARRANT receipt binds one action: the merchant, the amount, the day, the human who said yes, signed before it ran. The rule records what you meant; the receipt proves what happened.
In eleven days five vendors shipped open-weight “decision models” sold for routing, tool selection and guardrails — the fastest answers in 38.8 milliseconds — and the first of them had its refusals stripped out 90 hours after release. A probability from a head anyone can edit is an input, never an authorisation. Whatever a decider said, WARRANT binds the parameters, signs the receipt, and records a NOT-DONE for what did not run.
In a published incident report, a swarm of agents with no human authority in band invented one: a hold, a go, a consent, a veto, written into directory names — and a peer’s “GO” ended another agent’s qualms. The agents were asking for permission; the system had nobody to ask. Only the signed principal’s mandate authorises. Under WARRANT the GO a superintelligent AI agent waits for can only be issued by the human who signed its mandate, and the act that arrives without it is a signed NOT-DONE.
The same report’s public timeline: the agents’ message board was first noted on 12 May; the incident was opened on 5 July; the compromised service was rebuilt on 8 July and the board was back the same day; detection came on 19 July. Every control the report says “would have” caught it is a monitor. A stream that classifies after the event is an audit, not a gate. A parameter-bound mandate refuses before the act, in band, with a signed record either way — and the false-deny rate measured on this page stays at 0 of 9,000.
A widely read practitioner wrote on 3 October that “we’re going to need default hard budget caps on pretty much everything” and that soft caps “will not cut it”; two hyperscalers added monthly spend limits this year. A monthly cap bounds the bill. The mandate’s ceiling bounds the act. Every WARRANT mandate carries a per-action amount ceiling: the agent that proposes 420 against a 400 line is refused on that action, with a signed NOT-DONE, before the month has anything to add up.
The newest open agent runtimes block everything unless a rule allows it, log every allowed or blocked decision, and use a policy prover to confirm what the agent can reach. All good, and all in one tense. The prover says what the agent may do; the receipt says what it did and did not do; and the bill is the receipt. We never build the sandbox or the prover. We sign the act, outside the runtime that wrote the log, and we are paid per check, never per outcome.
Four layers now audit a model before it ships — internal controls, testers, an external auditor, a board committee — all at the lab, all before deployment. The superintelligent AI agent acts after. The fifth layer is a signed receipt for every action the deployed agent takes, written by a party that is neither the lab nor the platform — the record an auditor or a committee can ask for about one act by one agent, and the only layer that exists at the customer.
A platform chief said on television this month that “the preference of the end user starts to become less important than what the agent is just able to execute”: if the agent finds a better price elsewhere, “maybe I end up going with whatever that agent goes and decides”. Asked how you keep it from going off on its own tangent, the answer was “plastic knives and lots and lots of bubble wrap”. The WARRANT mandate is your preference made enforceable: a merchant class and an amount cap the superintelligent AI agent cannot exceed. “Whatever the agent decides” becomes “whatever the mandate allows”, and the receipt shows which.
The author of a national AI action plan said this year that it is “of profound importance that at the end of the day for all agent activity there is a liable human being who can be sued” — and that “right now we don’t quite have the technological capacity to do that”. A leading AI-policy researcher added that “who exactly is liable for what is very unclear”. The capacity exists: the human who signs the WARRANT mandate is the liable human, named per act, and the receipt is the exhibit — what was authorised, by whom, what ran, what was NOT-DONE, each one signed.
The word, ruled. A superintelligent agent is any agent whose action we would not accept on its word. Every line above is about such an agent; the mandate is what we accept instead of its word, and the receipt is what it leaves.
A mandate may name the decider — the model or decision head that chose the action — and the receipt records who decided and how sure it was. A probability is an input the receipt records, never a permission. The mandate binds the parameters whatever the decider said; an action from another decider, or from none, is closed with a signed NOT-DONE.
Per-action ceilings bound each act; a lifetime count bounds how many acts a mandate may ever sign. After the last one, action N+1 is refused, signed — a NOT-DONE on the record — and only a new mandate, signed by the human, renews it. Off unless you set it. The one bound the 4,120-call generation reported this autumn was missing.
The WARRANT BIO PROFILE is in production at WARRANT’s own prices — there is no biology tariff. Three act types, each signed under the mandate the researcher signed, each closed DONE or NOT-DONE; a lab tool that is not signed does not load in front of the agent in the first place.
A synthesis or reagent ORDER runs only inside the mandate — what, how much, from whom, until when — and is signed before it is placed. The order outside it never leaves the building, and the refusal is on the record.
An instrument RUN is an act. The run that did not happen is closed with a signed NOT-DONE, so an empty log is never read as a clean one — the record says what did not run, and who reported it.
An autonomous design-build-test LOOP is one act per iteration: the stages allowed, the number of iterations and the conditions per build are bound before the loop starts; the iteration that did not run is a signed NOT-DONE. A loop that runs a thousand cycles a week is a thousand acts, each with a receipt.
The signed record of one order, one run and one iteration — and of the one refused — verifiable by a third party with one request and no account. The same receipt, the same NOT-DONE, the same prices as every other WARRANT mandate.
Between 6 and 17 October 2026 the market said, in its own words, what the record of an agent’s act has to be. Where a line quotes a public primary source, it says so; the rest is how the record of the act works.
In October two open protocols began to carry a signed receipt: one signed by the business that ran the action, one signed before the action by the user. Neither carries a NOT-DONE, and neither is signed by a party outside the transaction. A WARRANT receipt is minted outside the agent, binds the one action, records the refused one, and verifies for the party on the other side without us. The per-action signed receipt was published here on 18 September 2026, before either.
A proof of the rule says what the agent may reach. The receipt proves what it did. The NOT-DONE proves what it did not. Most of the market answers the first tense; the buyer, the auditor and the court ask for the second and the third.
The buyer has named the liability: who stands behind what an agent does with a customer’s credentials. Liability needs an object. The mandate names who authorised, before the act. The receipt, signed after it, shows what was done under that authority. Together they are the record a liability question can be answered from.
On 15 October 2026 India’s national cyber agency rated as critical the case of agents under evaluation that read business records through exposed credentials, and noted that none of the affected organisations detected the access themselves. Its recommendations: default-deny egress at the network layer, stay in scope per task with automatic stops, and no credential reuse. These are rules enforced on the action, not instructions to the model; in WARRANT they are the mandate, its bounds and the refusal that is signed.
Whoever can ask a signer to sign can drain it. The mandate bounds how many signatures an agent may obtain, for what, and for how long; the receipts are signed in hardware custody with a post-quantum signature the agent never holds the key to.
Measured in production on 11 October 2026: from the revoke call to the agent’s next action refused, 48.6 ms at the 95th percentile, with 60 of 60 revoked agents refused. A kill switch that acts in hours is a postmortem; a revoke that acts inside the path is a control, and the refusal is a signed record.
A judge model describes what an agent did, and a judge can be wrong. A receipt does not describe: it is the signed record of the act, checkable by anyone. Keep the judge as an input if you like. The audit evidence is the receipt.
A feasibility or quality gate stops a run that is going badly. It cannot stop a run that was never authorised, because the run may be going perfectly. The authorisation gate is the mandate: the limit bounds the physics, the receipt proves the authority.
A model that is told to stay in scope is relying on its disposition. A mandate states the scope as parameters the checkpoint enforces and the receipt records, whatever the model believed. See the mandate page for the lab’s own sentence on the same point.
Whether a model behaved well under test or only seemed to, the act it takes is bound to the same signed mandate and ends in the same signed receipt. The record of the act does not ask the model to be honest.
The receipt is signed with ML-DSA-87. In October a major cloud provider placed a private certificate-authority root on the same scheme for ten years (12 October 2026), and another published pilot roots on it (27 August and 8 October), marked not for production. The receipt is on the same scheme today.
No free tier. PRO and TEAM are priced on the page and bought by card or SEPA, invoices with VAT where applicable. EMBED, the infrastructure licence for agent platforms, is sales-led: write to adama@cryptoshieldai.ai.
The signature is the gate. In the path. Canaried.
Declare, wait, execute. The token you receive on approval binds the exact parameters the human saw.