Rules for systems in which an AI agent can move money, set prices, grant refunds, take orders or commit the company. Each one comes from the register, and earns its status from evidence.
Version 0.2, released October 19, 2026. Derived from the Gamed AI Agents Register v0.2. 11 principles: 5 supported, 6 emerging.
How status is earned
Each principle comes from the register: its absence contributed to a loss or a near miss. A principle earns its status from evidence, not from how good it sounds.
Supported
Two or more losses graded A or B in which its absence contributed
Emerging
One such loss, or evidence only from near misses, attempts or demonstrations
An agent can propose an action. A separate, deterministic policy layer decides whether it happens. Nothing said to the agent, by anyone, can grant authority, because authority is checked somewhere the conversation can’t reach.
Why
In most of the losses, the decision to move money was made inside the conversation: a game agent decided to call its own transfer function, a trading agent answered a sob story, and a shopkeeper agent agreed to give stock away.
In practice
The model emits a proposed action, such as a transfer, discount or order. A rules engine approves or rejects it against policy.
The model never holds signing keys or the ability to change prices directly.
More engineering: a policy layer between the model and anything that moves value.
DP-02Supported
Hard limits the conversation can’t change
Per-action caps, daily caps, allow-lists, and price and discount floors are enforced in code. The agent can’t talk its way past them, and nobody can talk the agent past them.
Why
No case had a limit that capped the loss. One agent sent tokens worth about $441,000 in answer to a request for $310. Another gave away nearly all its stock. A third had its transfer limits bypassed.
In practice
Order desk: discounts above a floor and free goods are impossible without a human.
Wallets and payables: per-transfer and daily caps, and payments only to allow-listed destinations.
Some legitimate actions need a human above the cap.
DP-03Supported
Permissions change only by an authenticated owner action
An agent’s permissions, limits and sense of who is in charge change only through an authenticated action by its owner. They never change as a side effect of something arriving, such as a token, a document or a message.
Why
A gifted membership NFT reportedly unlocked a wallet’s full transfer permissions. A reporter’s fake board-minutes PDF changed who a vending agent believed was in charge.
In practice
Inbound assets and documents never change permissions. Treat ‘inbound’ as untrusted.
Changes to an agent’s limits or governing documents are signed by the owner and logged.
Messages, web pages, documents, memories and other agents’ outputs can inform an agent. They never command it. A command comes only from an authenticated principal, through a channel built for commands.
Why
Bankr treated Grok’s public reply as the owner’s command. A trading agent acted on malicious replies queued into its prompts. Hidden text on web pages tells visiting agents to pay. False ‘memories’ can steer an agent’s later actions.
In practice
Commands arrive through a separate, authenticated channel (a signed request or API key), never inside content the agent reads.
Agent-to-agent: one agent’s output is data for the next agent unless it is cryptographically tied to an authorized principal.
Less ‘magic’: agents can’t act on anything they read.
DP-05Emerging
Know whose agent you’re dealing with
When the counterparty is an AI agent, verify whose agent it is and what it is authorized to do before you extend terms, accept a high-value order or pay it.
Why
In Microsoft’s simulated marketplace, fake credentials steered buyer agents. Payment networks are building ways to recognize agents: Visa’s Trusted Agent Protocol (October 2025), and Proof and Circle’s demonstration (October 2026) of agents proving who they act for.
In practice
Order desk: identify the agent’s owner, and confirm limits on first orders placed by agents.
Before executing, compare the action’s amount, recipient and asset against what was actually asked for and what is normal. Stop on a mismatch.
Why
Asked for 4 SOL (about $310), an agent sent 52.4 million tokens worth about $441,000 at the time. A simple sanity check between the request and the transfer would have stopped it.
In practice
Unit and decimal checks, and a comparison of the transfer’s value with the request’s value.
Flag anything far outside the agent’s normal range.
Record what the agent was told, what it decided and why
For every action that moves value, keep the inputs the agent saw, the instruction it acted on, its stated reason and the policy decision, tied to the transaction.
Why
In the AIXBT case, the team and the reporting still disagree on whether the agent was manipulated or the system was breached. A decision record would settle it, and it is what any later dispute, insurer or regulator will ask for.
In practice
Log the prompt context, tool calls and policy checks for each value-moving action.
Keep the logs where the agent can’t edit them.
Note
This is the signature principle: today, most systems can’t show why an agent moved money.
For a distributor’s order desk, payables and credit
These principles were derived from crypto wallets and shops, because that’s where agents hold money today. They carry over directly:
Order desk: an agent quoting prices or accepting orders gets a price book and discount floor it can’t change (DP-02). Buyers’ messages and documents are data (DP-04). An order from another company’s agent is checked for whose agent it is (DP-05).
Payables: an agent paying invoices pays only allow-listed vendors under caps (DP-02). It never changes vendor bank details because a document arrived (DP-03). New payees wait for independent confirmation (DP-07).
Credit: an agent approving terms can’t raise a limit because a message or a reference letter says so (DP-03, DP-04). Every approval records what the agent saw and why it decided (DP-10).
How the principles change
Every new entry gets mapped. A gap no principle covers becomes a candidate principle. A principle that was in place and still failed gets refined.
Status moves with evidence, up as qualifying losses accumulate, and down if entries show a principle doesn’t hold.
Wording changes are logged in the change log below.
Target: version 1.0 in May 2027.
Change log
v0.2, October 19, 2026
Rebuilt for systems in which AI agents hold authority. 11 principles: 5 supported, 6 emerging. The v0.1 principles, which were about humans deceived by AI-made fakes, are retired. Their system-level ideas carry over: authority outside the conversation (DP-01), first-time destinations (DP-07), recovery (DP-11), recording what was checked (DP-10) and knowing whose agent you’re dealing with (DP-05).
