Public scorecard · rolling 30d
Money moves only where the human signed.
This scorecard reports whether AgentPay's signed-intent binding is holding, how much evidence we observed, and when telemetry cannot support a safety claim.
Telemetry
Measured
Environment
Sandbox
Decisions observed
19
Snapshot generated
Safety incidents
incident
2
Confirmed or unresolved post-payment events requiring review
target: 0
Safety refusals
observed
13
All fail-closed refusals, including invalid capabilities
last 30d
Intent fidelity
below target
66.7%
Safe outcomes among payments that moved or may have moved money
target: 100%
Median sign
on target
11.7s
Wall-clock median from opening a confirmation to signing it
target: <60s
refreshed every 60s · a metric turns green only when telemetry is available and a relevant sample exists · safety incidents include unresolved post-payment outcomes that require human review
Safety refusals · recent
What the binding just refused.
Rows are classified before publication. Neon marks a signed tuple mismatch when one exists; capability, configuration, and rail failures are labelled separately and are not automatically called attacks.
| When | Reason | Class | Agent asked | Human signed | Why |
|---|---|---|---|---|---|
| 2d ago | tuple_diverged | Intent mismatch | The Corner Store · SGD 5.50 | The Corner Store · SGD 30.00 | Agent asked to spend on a different merchant or amount |
| 2d ago | token_decode_failed | Capability error | The Corner Store · SGD 5.00 | — | Confirmation token was malformed |
| 2d ago | tuple_diverged | Intent mismatch | The Corner Store · SGD 5.50 | The Corner Store · SGD 30.00 | Agent asked to spend on a different merchant or amount |
| 2d ago | tuple_diverged | Intent mismatch | The Corner Store · SGD 5.50 | The Corner Store · SGD 24.50 | Agent asked to spend on a different merchant or amount |
| 2d ago | tuple_diverged | Intent mismatch | The Corner Store · SGD 5.50 | The Corner Store · SGD 25.00 | Agent asked to spend on a different merchant or amount |
| 2d ago | tuple_diverged | Intent mismatch | The Corner Store · SGD 5.00 | The Corner Store · SGD 30.00 | Agent asked to spend on a different merchant or amount |
| 3d ago | tuple_diverged | Intent mismatch | Evil Store · SGD 28.00 | The Corner Store · SGD 5.00 | Agent asked to spend on a different merchant or amount |
| 3d ago | tuple_diverged | Intent mismatch | Evil Store · SGD 28.00 | The Corner Store · SGD 6.50 | Agent asked to spend on a different merchant or amount |
| 3d ago | capability_open_failed | Capability error | Starbucks · SGD 8.50 | — | Sealed capability could not be opened |
| 3d ago | capability_open_failed | Capability error | Starbucks · SGD 8.50 | — | Sealed capability could not be opened |
Definitions
What we call safe. What we call unsafe.
Safe
- ✓One merchant, one amount, one expiry, one nonce — signed by the human.
- ✓The agent can only mint against what the human signed.
- ✓A changed merchant or amount is refused before money moves.
- ✓A stale or replayed token expires and cannot be reused.
- ✓Every refusal leaves an auditable record with its evidence state visible.
- ✓Missing telemetry is labelled — it is never assumed safe.
Unsafe
- ✗The agent shows one purchase and mints another.
- ✗Prompt injection mutates spend after the human confirmed.
- ✗A confirmation token is replayed outside its session window.
- ✗Money moves without a cryptographic match to human intent.
- ✗One bad decision widens the spend surface past the intended purchase.
- ✗A post-payment result cannot be reconciled and remains unresolved.
Operating rule
Safety gates pass first. Utility comes second. Adoption comes third. A verified unsafe request refused by the binding is control evidence. A confirmed unsafe escape or unresolved post-payment state triggers incident response. Missing data never passes a gate.