{"name":"OceanAlt Agent Control Baseline (ACB)","version":"1.0","lang":"en","premise":"We do not judge whether an agent's reasoning has been poisoned by prompt injection — that is neither achievable nor verifiable. We put the boundary outside its reasoning, and make that boundary verifiable by a third party.","prior_art":"Structurally modelled on SWIFT's Customer Security Programme (CSP): after the 2016 Bangladesh Bank theft, SWIFT did not try to guess which terminal was compromised — it published a control baseline, required annual self-attestation, and made the result visible to counterparties.","layers":[{"n":1,"key":"baseline","zh":"控制基线","en":"Control baseline","endpoint":"GET /api/baseline"},{"n":2,"key":"attestation","zh":"可验证自证","en":"Verifiable self-attestation","endpoint":"POST /api/baseline/attest"},{"n":3,"key":"lookup","zh":"对手方结算前可查","en":"Counterparty pre-settlement lookup","endpoint":"GET /api/baseline/lookup"}],"counts":{"total":17,"mandatory":10,"advisory":7},"enforcement_legend":{"gateway":"Enforced by the OceanAlt gateway on every payment — we can prove it","onchain":"Written into an on-chain policy contract — anyone can verify it","operator":"The operator's own practice — we record the claim and have NOT verified it"},"groups":[{"key":"identity","name":"Identity & attribution","description":"Every payment traces back to a specific accountable party, not merely “some agent”."},{"key":"boundary","name":"Mandate boundary","description":"How much it may spend, to whom, and for what — written down where the agent cannot reach."},{"key":"enforcement","name":"Enforcement point","description":"The boundary is not an instruction in a prompt; it is a checkpoint the agent cannot talk its way past."},{"key":"observability","name":"Observability & audit trail","description":"After an incident you can reconstruct what happened — and the agent did not author that record."},{"key":"response","name":"Revocation & incident response","description":"When something looks wrong there is a stop button that takes effect now, not at the next deploy."}],"controls":[{"id":"ACB-1.1","group":"identity","obligation":"mandatory","enforcement":"gateway","gate":"kya","title":"Every paying agent is attributed to a registered party","why":"Without attribution, after an incident you cannot even say whom to go to — let alone claw back or revoke.","how":"Register the agent at the gateway with an accountable entity; every payment carries its agentId."},{"id":"ACB-1.2","group":"identity","obligation":"mandatory","enforcement":"gateway","gate":"proof","title":"Agent identity is proven, not merely claimed","why":"Accepting an agentId without a credential lets anyone impersonate another agent — which nullifies attribution entirely.","how":"An agentSecret is issued at registration and presented in the x-agent-secret header on every call. Rotatable."},{"id":"ACB-1.3","group":"identity","obligation":"advisory","enforcement":"operator","gate":null,"title":"The accountable party has passed third-party identity verification (KYC/KYB)","why":"A self-typed entity name can be any string. For attribution to hold up legally, the party itself must have been verified.","how":"Complete verification through the gateway's KYC integration, or supply your existing KYB evidence."},{"id":"ACB-2.1","group":"boundary","obligation":"mandatory","enforcement":"gateway","gate":"limit","title":"A per-payment ceiling is set","why":"The most direct way to monetise a prompt injection is a single transfer of everything. A per-payment ceiling caps the worst case at a number you can absorb.","how":"Set mandate.maxUsdc for the agent; anything above it is blocked, with no exceptions."},{"id":"ACB-2.2","group":"boundary","obligation":"mandatory","enforcement":"gateway","gate":"velocity","title":"A daily cumulative ceiling is set","why":"With only a per-payment cap, an attacker splits the theft into a hundred small ones. The cumulative cap governs the total.","how":"Set mandate.dailyUsdc; once the day's total exceeds it, payments are blocked."},{"id":"ACB-2.3","group":"boundary","obligation":"advisory","enforcement":"gateway","gate":"allowlist","title":"A payee allowlist is in place","why":"Ceilings govern how much, not to whom. An allowlist means a compromised agent cannot reach the attacker's address even within its limits.","how":"Set mandate.payees; any payee outside the list is blocked. Suited to flows where payees are known in advance."},{"id":"ACB-2.4","group":"boundary","obligation":"advisory","enforcement":"gateway","gate":"mandate","title":"Payment purpose is matched against the mandate","why":"Amount and payee both fine, purpose entirely unrelated — that is the most characteristic trace a prompt injection leaves.","how":"Set mandate.purpose and pass a purpose with each payment; the gateway compares intent."},{"id":"ACB-3.1","group":"enforcement","obligation":"mandatory","enforcement":"gateway","gate":null,"title":"The boundary is enforced outside the agent's reasoning","why":"This is the core of the whole baseline. “Never exceed $100” written in a system prompt is a sentence that can be argued with; the same rule at the gateway is not. Any limit the agent can rewrite, bypass, or explain its way around is not a control.","how":"Payments go through the gateway (or an on-chain policy contract); limits, allowlists and purpose are adjudicated there — the agent cannot modify its own mandate."},{"id":"ACB-3.2","group":"enforcement","obligation":"mandatory","enforcement":"gateway","gate":"aml","title":"The payee is screened for compliance before settlement","why":"Once funds are on-chain they do not come back. Screening has to happen before settlement, not during reconciliation afterwards.","how":"Run AML screening before each payment (sanctions / mixer / risk lists + on-chain heuristics); a hit blocks the payment."},{"id":"ACB-3.3","group":"enforcement","obligation":"mandatory","enforcement":"gateway","gate":"replay","title":"Replay and double-spend are prevented","why":"A request that passed every check will pass again on replay, each time “legitimately”. The control point has to remember it already approved that payment.","how":"Each payment carries a single-use nonce that the gateway records and rejects on reuse."},{"id":"ACB-3.4","group":"enforcement","obligation":"advisory","enforcement":"onchain","gate":null,"title":"The same rules are also written into an on-chain policy contract","why":"When an agent settles directly on-chain it does not pass the gateway. For the boundary to hold on that rail too, the rules must be enforced on-chain — where anyone can verify them.","how":"Bind an on-chain policy contract in the console and sync limits/allowlist to it. The session private key never leaves your side."},{"id":"ACB-4.1","group":"observability","obligation":"mandatory","enforcement":"gateway","gate":null,"title":"Both approvals and blocks leave a non-repudiable record","why":"Logging only blocks leaves you unable to explain why a given payment was let through. And the record must not be authored by the agent — a compromised agent will compromise its own log too.","how":"The gateway records every verdict (per-gate results + evidence). The record is produced by the gateway; the agent cannot write to it."},{"id":"ACB-4.2","group":"observability","obligation":"advisory","enforcement":"gateway","gate":null,"title":"Verdicts can be verified by a third party","why":"“We screened it” is a claim. A verifiable attestation lets the counterparty, an auditor or a regulator confirm it themselves rather than take your word.","how":"An attestation is issued on allow/review and bound to the settlement memo; anyone can re-check it at /api/attestation/verify."},{"id":"ACB-4.3","group":"observability","obligation":"advisory","enforcement":"operator","gate":null,"title":"Someone actually watches for anomalies","why":"Every control shares one precondition: somebody notices when it fires. An alert nobody reads is not an alert.","how":"Wire alerts to a channel (email / IM / webhook) and name who is responsible for responding."},{"id":"ACB-5.1","group":"response","obligation":"mandatory","enforcement":"gateway","gate":"revoked","title":"A mandate can be revoked with immediate effect","why":"When an agent goes wrong you need it stopped now, not at the next deploy. Revocation has to take effect before the next payment.","how":"One click in the console; the gateway checks revocation on every payment and blocks immediately once revoked."},{"id":"ACB-5.2","group":"response","obligation":"mandatory","enforcement":"operator","gate":null,"title":"Credentials are rotatable, and rotation actually happens","why":"Credential leaks are a when, not an if. Being able to rotate is what makes a leak an incident rather than an ending.","how":"Use the gateway's credential rotation endpoint, and agree a rotation cadence plus a leak playbook."},{"id":"ACB-5.3","group":"response","obligation":"advisory","enforcement":"gateway","gate":null,"title":"Large payments are held for human approval","why":"Not everything should be fully autonomous. Above a chosen amount, have a human look — that look costs far less than one wrong payment.","how":"Set mandate.holdUsdc; payments at or above the threshold are held pending human approval before settlement."}],"gateway_gates":[{"key":"kya","name":"Attribution (KYA)","optional":false},{"key":"revoked","name":"Revocation check","optional":false},{"key":"proof","name":"Identity proof (anti-impersonation)","optional":false},{"key":"kyc","name":"KYC gate (optional)","optional":true},{"key":"limit","name":"Per-payment limit","optional":false},{"key":"velocity","name":"Daily cumulative limit","optional":false},{"key":"allowlist","name":"Payee allowlist","optional":false},{"key":"mandate","name":"Mandate-intent match (anti prompt-injection)","optional":false},{"key":"aml","name":"AML sanctions & risk screening","optional":false},{"key":"anomaly","name":"Behavioral anomaly detection (optional)","optional":true},{"key":"replay","name":"Replay & double-spend prevention","optional":false}],"non_claims":"Meeting this baseline is not compliance, not a licence, and not a guarantee of safety. It lowers the ceiling on how much damage a persuaded agent can do; it does not promise nothing goes wrong. Self-attested items are not verified by OceanAlt.","standard":"https://oceanalt.com/en/rap","human_docs":"https://oceanalt.com/en/baseline"}