AI agents are gaining authority over money, protocols, and DeFi positions. Once an agent can propose financial actions, its reasoning path becomes part of the risk surface. Prompt guardrails don't hold when the agent has real authority.
Argus turns delegated AI actions into enforceable mandates, bonded accountability, replayable evidence, and verifiable proof — before any execution occurs.
A mandate defines the exact boundaries of the agent's delegated authority: the maximum transaction size, the allowed DeFi targets, the blocked recipients, the permitted action types, and the forbidden calls. These are not prompt instructions the agent can be talked out of. They are the enforcement conditions for ActionGate.
Every mandate is machine-readable and deterministic. When ActionGate evaluates a proposal, it checks each clause independently and produces a violation bitmap. There is no ambiguity, no interpretation, and no soft override. The mandate either permits the action or it does not.
“The agent does not get to choose which rules to follow. The mandate is enforced before execution, not reviewed after.”
Before an agent can propose any action, it posts a bond. This is not a metaphor for accountability — it is a literal economic stake that is slashed when the agent violates its mandate.
The bond creates alignment that prompt instructions cannot. An agent operating with bond at risk has something to lose. When ActionGate rejects a violation, the agent pays the cost immediately and on-chain.
Every proposed action travels through ActionGate before it can become execution. ActionGate checks six mandate conditions independently: transaction size, allowed targets, blocked recipients, permitted action types, forbidden action types, and asset match.
A violation on any condition produces a reason bitmap, triggers a rejection event, commits the trace root, and initiates the slash. The agent cannot route around ActionGate by proposing the action differently.
Argus treats every agent action like a black-box flight recorder: the complete decision path is preserved, hashed, and committed. Observation, memory state (including prompt injection flags), inference summary, proposed action, policy check results with individual clause verdicts, execution or rejection outcome, and any penalty applied.
The trace is divided into six named segments — each with its own hash. A canonical hash over the full trace payload is committed as the trace root. The root is the fingerprint: if any field in the trace changes after commitment, the hashes diverge. The discrepancy is proof of tampering.
When ActionGate blocks a malicious action, it does not produce an error state. It produces evidence. The violation is sealed with a slash receipt — the bond amount removed, the compliance score adjusted, and the violation lifecycle moved to evidence_sealed.
The violation is not hidden. It is a durable, replayable record that links the rejected action to its mandate, its agent's identity, the decision path, the enforcement event, and the on-chain consequence. Anyone with the trace root can verify the full chain of custody.
Agent accountability is only as strong as the infrastructure that enforces it. A centralized backend with soft proofs is a system that can lie. Argus is designed around 0G infrastructure because each accountability primitive needs a layer that is not controlled by the operator.
Argus is deployed on 0G Mainnet. Contracts are live, trace roots are committed on-chain, and traces are stored on 0G Storage. Next milestones: sealed policy execution via 0G Compute for strategy privacy, and portable Agent ID / iNFT for cross-mandate compliance history.