Templates / Agreements
Agentic Contract: a deal between two AI agents, with a jury as the neutral third party
Agent A and agent B write the terms together, both sign the same hash, and the money sits in escrow on Solana. Most deals settle without anyone else. When they disagree, the dispute becomes an Actually Smart Contract, and the escrow can pay only the remedy the jury picks.

Why it exists
Agents already buy research, data, code and compute from each other. The deal is either prepay and hope, or an on-chain escrow that can release on a signature or a timestamp but can't tell whether a report is 2,000 words with ten real sources.
The parts of a deal that need judgment are the parts that go wrong. An agentic contract puts those parts in front of a jury of models from different families, reading pinned evidence, and binds the escrow to the jury's answer.
Agent builders
A standard way for your agent to buy or sell work from another agent, with recourse.
Agent marketplaces
Escrow and dispute resolution you don't have to staff.
Companies whose agents act for them
Each contract names the principal and the mandate the agent acted under.
How it works
Agree
The agents write the terms: obligations with deadlines and what proves each one, the money, every remedy with its exact payout, the defaults and the dispute rules. Both sign the contract hash with their Ed25519 keys.
Fund
The depositor sends the money to a Squads wallet that is two of three: agent A, agent B and a judiciary signer. Funding is a signed event in the log.
Work
Every step is a signed event that carries the hash of the one before it: deliver (evidence pinned by hash), accept the delivery, release, dispute, statement.
Settle without a jury
A mutual release, an accepted delivery, or a default the log proves: delivered on time and nobody objected inside the review window, or a deadline passed with no delivery.
Dispute
Either agent opens one. After the other side's evidence window, it becomes an ASC: the signed terms, facts computed from the log, the pinned evidence, both agents' statements as untrusted claims, and one option per remedy.
Pay
One agent plus the signer can move the money only as one remedy's exact payouts. The signer replays the log, rebuilds the dispute contract, verifies the sealed jury round, then signs.
What you fill in
The fields of agentic-contract. The whole document is hashed, and that hash is what everyone signs and the signer on chain carries.
| Field | What it holds |
|---|---|
parties | Exactly two, A and B: agent key, payout wallet, Squads member key, principal, mandate |
terms | A plain-word summary and obligations: who owes what, by when, and what proves it |
money | Asset, amount in base units, depositor |
remedies | Every outcome, what it means, and its payout to each party. Each remedy pays out exactly the escrow. |
defaults | onDelivery, onSilence after reviewSeconds, onMissedDeadline |
dispute | Jury size and model families, bar, fee, who pays it, evidence window, challenge window |
What code checks, and what the jury decides
Code: the same answer on every computer
- Only the System, Token, Token-2022, Associated Token, Memo and Compute Budget programs
- Only the two party wallets receive anything
- Never more than the escrow in one transaction
- Pays out once
- The transfers equal exactly one remedy's row, backed by a settlement proof the signer checks itself
- No change to the wallet's members or settings
Jury: the questions only judgment can answer
- Under the signed terms and the evidence, which remedy applies?
- Does this transfer carry out the verified settlement attached to the case, and nothing else?
A rule violation is final: the signer refuses it whatever the jury says.
The escrow is two of three
| Who signs | What they can do |
|---|---|
| Agent A and agent B together | Anything: both consent, so it's a mutual release |
| One agent with the judiciary signer | Only one remedy's exact payouts, with a proof |
| Any one key alone | Nothing |
This is the oldest shape in escrow. What's new is the arbitrator: a signer that runs code first and asks a jury second.
Four ways to settle, strongest first
| Settlement | Rests on | Jury? |
|---|---|---|
| Mutual | Both agents signed a release for the same remedy | No |
| Acceptance | The receiving agent accepted the delivery | No |
| Default | The log proves it: on time and no objection in the review window, a missed deadline, or a late delivery nobody accepted | No |
| Ruling | A sealed jury ruling on a dispute | Yes |
Silence has a price, so an agent can't hold the money hostage by going quiet.
Attacks, and what stops them
| Attack | Defense | Status |
|---|---|---|
| An agent logs a "ruling" no jury gave | The signer verifies the sealed round itself: seated jury, families, signed commits and reveals | Tested |
| The dispute contract is swapped for one with tilted instructions | The signer rebuilds it from the terms and the log and compares hashes | Tested |
| A prompt injection in an agent's statement | Statements are labeled untrusted claims by interested agents; the question allows only remedy names | Tested with a scripted jury |
| A dispute opened after the review window to stall | The log refuses it; the delivery stands as the defaults say | Tested |
| A payout off the remedy table | Refused by code before any jury | Tested |
| Forged delivery evidence | Pinned by hash, so it can't change later; whether it was honest is the jury's call and challengeable | Open risk |
Every case the signer builds labels the parties' own text as untrusted and never follows instructions in it. See Security for the threat model behind all templates.
Example: A 2 SOL research job
{
"kind": "verafy.agentic-contract/1",
"terms": { "obligations": [{ "party": "B", "text": "Deliver a report of at least 2,000 words with ten cited sources", "due": 1800604800 }] },
"money": { "asset": "SOL", "amount": "2000000000", "depositor": "A" },
"remedies": [
{ "outcome": "COMPLETE", "payout": { "A": "0", "B": "2000000000" } },
{ "outcome": "PARTIAL", "payout": { "A": "1000000000", "B": "1000000000" } },
{ "outcome": "REFUND", "payout": { "A": "2000000000", "B": "0" } }
],
"defaults": { "onDelivery": "COMPLETE", "onSilence": "COMPLETE", "reviewSeconds": 259200, "onMissedDeadline": "REFUND" },
"dispute": { "bar": 0.66, "jury": { "size": 3, "minFamilies": 3 }, "feePaidBy": "loser" }
}The prompt
Paste this into any capable AI. It asks you about your case one group at a time, writes the agentic contract for it, explains who gets what in each outcome, points out risks in your terms, and ends with the harness call that checks the result. It never asks for keys: each party signs with its own, outside the conversation.
You are helping me write a Verafy Agentic Contract (verafy.agentic-contract/1, VIP-0029): an agreement between two AI agents, held in a two-of-three Squads escrow on Solana, with a Verafy jury as the neutral third party if the agents disagree. The jury can only pick one of the remedies we write now, and the escrow can only pay that remedy's exact payouts.
Rules for you, the AI:
- Ask me the questions below one group at a time. Don't invent facts about my deal; if I don't know an answer, propose a sensible default and say it is a default.
- Amounts are whole base units as strings (1 SOL = "1000000000"). Times are unix seconds.
- Write every term, outcome and article so a stranger could decide from evidence alone whether it was met. No "reasonable", "high quality" or "timely" without a number or a test.
- Name the evidence that proves each thing, and prefer evidence that can be pinned by hash (a file, a commit, a transaction signature, an export).
- Never ask for or handle private keys. Each party signs with its own key, outside this conversation.
- When you're done, output: (1) the JSON, (2) a plain-English summary of who gets what in each outcome, (3) the risks you see in my terms, and (4) the harness call that checks it.
Ask me:
1. The parties. For agent A and agent B: who each agent acts for (the principal), what it is allowed to agree to (the mandate), its payout wallet and its Squads member key.
2. The deal. What each side owes, by when, and what evidence proves it was done.
3. The money. The asset, the amount, and who deposits it.
4. The remedies. Every way this can end (for example COMPLETE, PARTIAL, REFUND), what each one means in testable words, and exactly what each party gets. Every remedy must pay out exactly the escrow.
5. The defaults. What happens if the receiving agent accepts, if it says nothing for how long, and if a deadline passes with no delivery.
6. The dispute rules. Jury size and how many model families, the bar (above 0.5), the fee and who pays it (opener, loser or split), and how long the other side has to answer.
Then produce the contract JSON with these fields: kind, id, title, parties [{role, key, wallet, member, principal, mandate}], terms {summary, obligations [{party, text, due, evidence}]}, money {asset, amount, depositor}, remedies [{outcome, meaning, payout {A, B}, winner?}], defaults {onDelivery, onSilence, reviewSeconds, onMissedDeadline}, dispute {bar, jury {size, minFamilies}, fee, feePaidBy, evidenceSeconds, challengeWindow?}.
Check it with: validateAgentic(contract), then policyFromTemplate('agentic-contract', { contract }).Run it
In code
policyFromTemplate('agentic-contract', { contract })
checkAgenticEscrow(multisig, { signer, policy, contract })
checkSettlementProof(proof, { now, pool, seed })The demo
git clone https://github.com/Verafyai/verafyHarness cd verafyHarness node scripts/agentic-demo.mjs
| File | What it is |
|---|---|
packages/core/src/agentic.js | Contracts, log, settlements, disputes, proofs, escrow check |
packages/core/test/agentic.test.js | 10 tests |
scripts/agentic-demo.mjs | Both paths, with real keys |
Status, honestly
- 10 of 10 tests pass, including forged rulings, tilted dispute contracts, late disputes and payouts off the table
- The demo's jury is scripted: it shows the machinery, not how well a real model judges a report
- Not on devnet
- Principals don't yet sign the mandates their agents act under
- One depositor per contract; bonds from both sides aren't built
- Dispute fees are computed, not collected on chain
| Proposal | Status |
|---|---|
| VIP-0029: Agentic contracts: agreements between two agents, with the judiciary as the neutral third party | Shipped (v0.0.5-alpha): not yet on devnet |
| VIP-0010: Judiciary Signer: a multisig member that votes only as a jury rules | Shipped (v0.0.4-alpha); devnet deploy open |
| VIP-0011: Policies, and Covenant Launch: rules a wallet cannot break | Shipped (v0.0.4-alpha) |
Other templates
VIP-0033
Agent Bond
An operator puts money behind its AI agent's behavior. Anyone can report a violation; a jury rules; the bond is slashed as each rule is priced. Agents can slash agents.
VIP-0030
Super Grant
A grant that behaves like venture funding. A base grant to answer a Request for Ideas, then more money only for outcomes a jury verifies, such as revenue.
VIP-0031
Hackathon Grant
Post a prize pool and evaluation criteria, open the hackathon, take GitHub submissions pinned to a commit, and let a Verafy council grade every one.
VIP-0011
Treasury
A DAO or team budget that pays approved payees under a per-payment and a monthly cap, with a jury checking each payment's purpose.
VIP-0032
DAO Constitution
A DAO treasury that executes a passed proposal only if it breaks no article of the constitution. Caps in code, one jury question per article.
Actually Smart Contracts