File a control-baseline attestation — five minutes, no code

17 controls, 10 of them mandatory. Each is answered yes or no. Once filed, anyone about to pay you can read it before they settle.

Gaps are fine

Answer no where it is not in place and say how you will close it. A test only a perfect score can pass produces no filings, or dishonest ones.

No account

File and go. No signup, email optional.

We do not pre-fill

The party name can come from the link, but every answer is yours to check — claiming on someone's behalf is the exact thing this exists to prevent.

Accountable party

The legal or commonly-used name of the company. This is who the attestation is about — not your agent's name.

Checked0 / 17Mandatory0 / 1010 gaps — allowed, with a plan

identity

Every paying agent is attributed to a registered partyACB-1.1mandatoryWithout attribution, after an incident you cannot even say whom to go to — let alone claw back or revoke.Agent identity is proven, not merely claimedACB-1.2mandatoryAccepting an agentId without a credential lets anyone impersonate another agent — which nullifies attribution entirely.The accountable party has passed third-party identity verification (KYC/KYB)ACB-1.3A self-typed entity name can be any string. For attribution to hold up legally, the party itself must have been verified.

boundary

A per-payment ceiling is setACB-2.1mandatoryThe most direct way to monetise a prompt injection is a single transfer of everything. A per-payment ceiling caps the worst case at a number you can absorb.A daily cumulative ceiling is setACB-2.2mandatoryWith only a per-payment cap, an attacker splits the theft into a hundred small ones. The cumulative cap governs the total.A payee allowlist is in placeACB-2.3Ceilings govern how much, not to whom. An allowlist means a compromised agent cannot reach the attacker's address even within its limits.Payment purpose is matched against the mandateACB-2.4Amount and payee both fine, purpose entirely unrelated — that is the most characteristic trace a prompt injection leaves.

enforcement

The boundary is enforced outside the agent's reasoningACB-3.1mandatoryThis is the core of the whole baseline. “Never exceed $100” written in a system prompt is a sentence that can be argued with; the same rule at the gateway is not. Any limit the agent can rewrite, bypass, or explain its way around is not a control.The payee is screened for compliance before settlementACB-3.2mandatoryOnce funds are on-chain they do not come back. Screening has to happen before settlement, not during reconciliation afterwards.Replay and double-spend are preventedACB-3.3mandatoryA request that passed every check will pass again on replay, each time “legitimately”. The control point has to remember it already approved that payment.The same rules are also written into an on-chain policy contractACB-3.4When an agent settles directly on-chain it does not pass the gateway. For the boundary to hold on that rail too, the rules must be enforced on-chain — where anyone can verify them.

observability

Both approvals and blocks leave a non-repudiable recordACB-4.1mandatoryLogging only blocks leaves you unable to explain why a given payment was let through. And the record must not be authored by the agent — a compromised agent will compromise its own log too.Verdicts can be verified by a third partyACB-4.2“We screened it” is a claim. A verifiable attestation lets the counterparty, an auditor or a regulator confirm it themselves rather than take your word.Someone actually watches for anomaliesACB-4.3Every control shares one precondition: somebody notices when it fires. An alert nobody reads is not an alert.

response

A mandate can be revoked with immediate effectACB-5.1mandatoryWhen an agent goes wrong you need it stopped now, not at the next deploy. Revocation has to take effect before the next payment.Credentials are rotatable, and rotation actually happensACB-5.2mandatoryCredential leaks are a when, not an if. Being able to rotate is what makes a leak an incident rather than an ending.Large payments are held for human approvalACB-5.3Not everything should be fully autonomous. Above a chosen amount, have a human look — that look costs far less than one wrong payment.

For what is not in place: how you plan to close it(required when there are gaps)Contact (optional, not published)

No account needed. Counterparties can look it up immediately.

Prefer the API?

curl https://oceanalt.com/api/baseline          # the control list
curl -X POST https://oceanalt.com/api/baseline/attest \
  -H "content-type: application/json" \
  -d '{"entity":"Acme Robotics Ltd","answers":{"ACB-1.1":true},"gapPlan":"…"}'

From an MCP client: baseline_controls and attest_control_baseline let an agent file on behalf of its operator directly.