Mandate 1Paid
1 test USDC
- Caller
- Agent key
- Payee
- probarion-payee.testnet
- Event
spend_paid
Spend by mandate.Prove every payment.
A mandate layer for AI agents on NEAR. Your agent pays people and services only inside limits you signed. A contract checks every payment, and every decision goes into a signed ledger anyone can verify.
Testnet today, mainnet planned. You need no account to read the chain or run the verifier.
Mandate 999Refused
PROBARION:
- Caller
- Agent key
- Payee
- None on record
- Paid
- Nothing
Two real calls by one agent key on v0.probarion.testnet, with test tokens. The contract decided both.
Giving an AI agent a wallet means trusting a prompt with money. Probarion moves the rule into a NEAR contract.
0
full-access keys on the vault. A public RPC call shows it.
1
method the agent's key can call: spend.
0
recipient arguments on spend. The payee comes from the mandate.
9
checks anyone can run. Live, they read the chain. Offline, they check a snapshot against itself, so take the snapshot yourself.
What happens to one payment
Three parties look at it in turn. The model may advise. Code decides. The contract has the last word.
1
The owner signs a mandate
From their own wallet: who gets paid, how much per payment and in total, how many times, until when, and above what amount a person must approve.
An example mandate
payeeprobarion-payee.testnet
max_per_payment5 USDC
max_total20 USDC
max_uses5
approval_above5 USDC
2
A private model proposes, if there is one
It runs in a TEE on NEAR AI Cloud. Its attestation is bound by a nonce to one position in one vault's ledger. It only gives advice: it cannot widen a mandate.
Adapter built. First live attested run in progress.What the proposal is bound to
actionpay
mandate_id1
noncenext ledger position + vault
signatureprovider_tee
3
Code decides, and signs before anything moves
Deterministic rules run first and cannot be removed. The SDK signs the decision into the ledger before anything is sent, and it records refusals too.
The testnet smoke run sent spends without a ledger.decide(), built-in rules include
mandate.none
mandate.payee_mismatch
mandate.over_total
invoice.duplicate
vault.daily_backstop
4
The contract decides last
Even if every line of off-chain code were wrong, the vault refuses a payment outside its mandate. Above the approval limit, the spend waits for a person.
check_spend on mandate 1, at most 5 USDC, valid until 2026-12-01
2 USDCok: true
6 USDCok: false, OverPerPayment
5
Anyone can check the record
The SDK anchors the ledger root on the vault. The verifier ties each spend in a snapshot to exactly one decision, with no server and no account. Offline, those spends come from the file. A live run reads them from the chain.
The testnet vault has no ledger key or anchors yet, so this command runs on a test fixture. Build it from a clone first (README step 1).$ node packages/cli/dist/bin.js verify --offline packages/core/test/fixtures/valid-snapshot.json
9 passed, 0 failed, 0 unproven
RESULT: PASS
The agent cannot name a payee.
A hijacked prompt can ask for anything. spend has no field to put an address in. For a cross-chain payee, the vault builds the withdrawal memo itself, from the mandate.
Change one field. Watch it break.
This is the real verifier from @probarion/core. It runs in your browser on a committed test fixture: five entries signed with test keys, not a live vault. It shows one thing: the verifier catches an edit that was not re-signed. Nothing leaves the page.
Signed ledger, test fixturePASS. As recorded.
| Seq | Kind | Outcome | Mandate | Amount, USDC |
|---|---|---|---|---|
| 0 | Decision | Allow | 1 | 25.000000 |
| 1 | Payment | Paid | 1 | 25.000000 |
| 2 | Decision | Allow | 2 | 40.000000 |
| 3 | Payment | Burned for Base | 2 | 40.000000 |
| 4 | Decision | Refuse: payee mismatch | 1 | 25.000000 |
PASS9 passed, 0 failed, 0 unproven
- aSignaturespass
- bHash linkspass
- cAnchorspass
- dA decision for every spendpass
- eAttestationspassThe hardware quote and the request are not checked here.
- fLocked vaultpass
- gIntents keyspass
- hBurn memospass
- iFactory versionpass
Recorded result. Press a button to run the verifier yourself.
Read it on chain
A smoke run of the contract alone on NEAR testnet, on 2026-11-01. Test tokens, no model and no ledger in this run.
Paid a NEAR account
1 test USDC to probarion-payee.testnet. Events spend_submitted, ft_transfer, spend_paid.
Burned for a Base address
1 test USDC with the memo WITHDRAW_TO:0x1111…1111 the vault built from the mandate. On testnet nothing leaves NEAR.
Refused a mandate that does not exist
The contract answered PROBARION:NoMandate. Nothing was paid.
What works today, and what does not
Vault contractOn testnet
Offline verifier, checks a to iShipped in source
Reproducible buildsShipped
Web consoleIn progress
Public proof pageBuilt, no public vault yet
TypeScript SDK and CLIIn source, not on npm
Payables agentIn progress
Live attested model runIn progress
Vault factoryBuilt, not deployed
Canary public challengePlanned
MCP serverPlanned
Mainnet vaultPlanned
No third party has audited this code. Read the threat model (opens in a new tab), including what verify does not prove yet. The testnet vault runs a build older than the current source, and the fixed build's hash is recorded in contracts/code-hashes.json.
Don't trust us.Run the verifier.
A live run reads the chain itself: verify --vault. On the testnet vault it fails checks d and h today, because the smoke run sent its spends without a ledger.