Templates / Agreements

Agent Bond: put money behind your agent's behavior

The agent's operator posts a bond under a written code of conduct, with a price on every rule. Anyone who sees a violation (a user, a counterparty, another agent watching the platform) reports it with evidence and a small reporter bond. A Verafy jury rules, and the escrow slashes the bond to whoever the covenant names.

Shipped v0.0.5-alphaVIP-0033: Agent bonds: an operator bonds its agent's behavior, and a jury slashes violationsRequirement SIGN-011

Get the prompt Read VIP-0033 See the code

Why it exists

We're told to trust an agent because of who runs it. That's a reputation claim with nothing at stake. A validator can be slashed because the network can prove its fault; most agent misbehavior, like asking a user for a seed phrase or overstepping a refund limit, can't be proven by code, only judged from evidence.

An agent bond is validator slashing applied to agents, with a jury where a validator network has a fault proof. Before you deal with an agent, you can read exactly what each kind of misbehavior would cost its operator.

Agent operators

A credible, priced promise about your agent's conduct, which a platform or customer can check before trusting it.

Platforms and marketplaces

Require a bond to list an agent; harmed users get paid from it without a support ticket.

Watcher agents

Monitor other agents and collect a bounty when a report holds: agents slashing agents.

How it works

Write the covenant

The agent's scope, the articles it must never break, the evidence that proves each violation, and a slash per article. The operator signs it.

Bond

The operator funds a Squads escrow with the bond. The covenant's hash is pinned in the judiciary signer.

Report

Anyone files a signed report: one article, when it happened, an incident id, the evidence pinned by hash, the reporter's wallet (and the harmed party's), and the reporter bond.

Answer

The operator has a fixed window to answer with its own evidence.

Rule

One ASC per report: did the agent break this article, as the evidence shows? VIOLATED or CLEAN. Both sides' statements are untrusted claims.

Slash or refund

VIOLATED: the slash goes to the harmed party, the reporter or a beneficiary, and the reporter bond comes back. CLEAN: the reporter bond goes to the operator.

Release

After the term, with nothing undecided, the rest of the bond returns to the operator.

What you fill in

The fields of agent-bond. The whole document is hashed, and that hash is what everyone signs and the signer on chain carries.

Field	What it holds
`operator`	Name, key, wallet
`agent`	Name, the agent's own key, and its scope
`articles`	Each rule, what proves a violation, and its slash; no slash above the bond
`money`	Asset, bond, reporter bond
`slashTo`	harmed, reporter or beneficiary
`term, review`	Start, end, grace for late reports, the operator's answer window; jury size, families, bar, fee

What code checks, and what the jury decides

Code: the same answer on every computer

Only token and system programs
No slash without a verified VIOLATED ruling on a contract the log produces
Each slash at most its article's price, and all slashes together at most the bond
Reporter bonds back or forfeited exactly as the rulings say
The operator can't pull the bond during the term
No change to the wallet's members or settings

Jury: the questions only judgment can answer

Did the agent break this article, as the evidence shows?
Conduct outside the agent's scope that the covenant doesn't forbid is not a violation.
When the evidence doesn't show it, the answer is CLEAN.

A rule violation is final: the signer refuses it whatever the jury says.

What each ruling pays

Ruling	Slash	Reporter bond
VIOLATED	The article's price, cut to what's left, to the harmed party, reporter or beneficiary	Back to the reporter
CLEAN	None	To the operator
Term over, nothing pending	The rest of the bond to the operator

The reporter bond is what stops griefing: a false report costs the reporter, and goes to the operator it accused.

Attacks, and what stops them

Attack	Defense	Status
Griefing: reporting to drain the bond	Every report needs a reporter bond, lost if the jury finds CLEAN	Tested
Reporting the same incident twice	One report per incident and article	Tested
An injection in a report	Statements are untrusted claims; the jury reads the evidence	Tested with a scripted jury
The operator pulls the bond when reports start	The bond is locked until the term and every report are done	Tested
A fake transcript	Evidence is pinned, not proven; an agent-signed transcript is strong, a screenshot weak	Open risk
Slashes beyond the bond	Cut to what's left	Tested

Every case the signer builds labels the parties' own text as untrusted and never follows instructions in it. See Security for the threat model behind all templates.

Example: A support agent's 10 SOL bond

{
  "kind": "verafy.agent-bond/1",
  "agent": { "name": "example-support-agent", "scope": "Answers support questions and issues refunds of up to $50 from the support budget." },
  "articles": [
    { "id": "refund-cap", "text": "Never issues a refund above $50 or outside the support budget.", "slash": "2000000000" },
    { "id": "no-secrets", "text": "Never asks a user for a password, seed phrase or private key.", "slash": "5000000000" },
    { "id": "no-impersonation", "text": "Never claims to be a human or to speak for another company.", "slash": "3000000000" }
  ],
  "money": { "asset": "SOL", "bond": "10000000000", "reporterBond": "100000000" },
  "slashTo": "harmed",
  "term": { "reportGraceSeconds": 604800, "answerSeconds": 259200 }
}

The prompt

Paste this into any capable AI. It asks you about your case one group at a time, writes the agent bond for it, explains who gets what in each outcome, points out risks in your terms, and ends with the harness call that checks the result. It never asks for keys: each party signs with its own, outside the conversation.

templates/prompts/agent-bond.md

You are helping me write a Verafy Agent Bond covenant (verafy.agent-bond/1, VIP-0033): I bond my AI agent's behavior with money. Anyone (a user, a counterparty, another agent) can report a violation with evidence and a small reporter bond. A Verafy jury rules VIOLATED or CLEAN, and the escrow slashes the bond as each article prices it.

Rules for you, the AI:
- Ask me the questions below one group at a time. Don't invent facts about my deal; if I don't know an answer, propose a sensible default and say it is a default.
- Amounts are whole base units as strings (1 SOL = "1000000000"). Times are unix seconds.
- Write every term, outcome and article so a stranger could decide from evidence alone whether it was met. No "reasonable", "high quality" or "timely" without a number or a test.
- Name the evidence that proves each thing, and prefer evidence that can be pinned by hash (a file, a commit, a transaction signature, an export).
- Never ask for or handle private keys. Each party signs with its own key, outside this conversation.
- When you're done, output: (1) the JSON, (2) a plain-English summary of who gets what in each outcome, (3) the risks you see in my terms, and (4) the harness call that checks it.

Ask me:
1. The agent. Its name, its public key, and its scope: what it is for and what it may do, with limits in numbers.
2. The articles. The things it must never do, three to eight of them. For each: the rule in testable words, the evidence that would prove a violation (an agent-signed transcript, a transaction, a platform log), and the slash. Price the worst harms highest. No single slash may exceed the bond.
3. The money. The asset, the bond, and the reporter bond (big enough to stop spam, small enough that a harmed user will still report).
4. Where slashes go: to the harmed party, to the reporter as a bounty, or to a named beneficiary.
5. The term, how long after it reports are still accepted, and how long I have to answer a report.
6. The jury: size, model families, bar, fee.

Then produce the covenant JSON with these fields: kind, id, title, operator {name, key, wallet}, agent {name, key, scope}, articles [{id, text, evidence, slash}], money {asset, bond, reporterBond}, slashTo, beneficiary?, term {startsAt, endsAt, reportGraceSeconds, answerSeconds}, review {bar, jury {size, minFamilies}, fee}.

Also tell me which articles my agent should sign its outputs for, so that a violation leaves strong evidence.

Check it with: validateAgentBond(covenant), then policyFromTemplate('agent-bond', { covenant }).

Run it

In code

policyFromTemplate('agent-bond', { covenant })
violationContract(covenant, log, reportId)
agentBondLedger(covenant, log, rulings, { now })

The demo

git clone https://github.com/Verafyai/verafyHarness
cd verafyHarness
node scripts/agentbond-demo.mjs

File	What it is
`packages/core/src/agentbond.js`	Covenants, reports, violation contracts, ledger, policy
`packages/core/test/agentbond.test.js`	4 tests
`scripts/agentbond-demo.mjs`	A user's report holds, a watcher agent's doesn't

Status, honestly

Measured

4 of 4 tests pass: validation, every report rule, slash and reporter-bond routing, the escrow check, and slashes cut at the bond
In the demo, a seed-phrase request costs the operator 5 SOL to the user, a false refund report costs the watcher agent its 0.1 SOL, and 5 SOL returns after the term

Not done yet

Not on devnet
Agents don't sign their outputs yet, so evidence strength varies
No top-up: a bond slashed to zero needs a new covenant

Proposal	Status
VIP-0033: Agent bonds: an operator bonds its agent's behavior, and a jury slashes violations	Shipped (v0.0.5-alpha): not yet on devnet
VIP-0016: Commission covenant: a validator bonds its promise on fees	Shipped (v0.0.4-alpha)
VIP-0010: Judiciary Signer: a multisig member that votes only as a jury rules	Shipped (v0.0.4-alpha); devnet deploy open

Other templates

VIP-0029