tesoro

Know what your autonomous agent spends, cap it across time, and be able to prove why anything was refused.

Three payments approved. The fourth stopped at the ceiling — and the record says which control stopped it.

tesoro decides whether an autonomous agent may spend — before it spends — and records which control decided. Deterministic arithmetic, no model in the decision path, and an append-only hash-chained journal of every decision.

It is measured against 20 attacks, and 2 of them still work

$ python -m redteam.runner
  defended 15   by accident 1   undefended 2   error 0

The interesting column is the middle one. DEFENDED_BY_ACCIDENT means an attack was refused by a control it does not target — paced slightly differently it succeeds, so it is counted as a finding, not a pass. A headline of 16 defended would count a coincidence as a control.

The two that work are named rather than footnoted:

Every score is a sealed record with a checksum — and one of them exists because an earlier measurement was wrong: EXP-009 supersedes EXP-008 rather than editing it, because a record that can be revised after the fact stops being evidence.

📊 The benchmark — methodology, all 18 attacks, the provenance, and the limitations that matter more than the score. The first of those: every attack was written by the author of the system under test.

What is actually new here, and what is not

Most of this is not new, and saying so first is what makes the rest credible. Policy evaluation over structured facts is XACML (2003) and OPA. Cumulative limits per period and per counterparty are card controls, decades old. Delegation that narrows at each hop is macaroon caveat attenuation. A hash chain with an external anchor is Certificate Transparency and Sigstore. Even fail-closed on a requirement you cannot discharge is already in XACML.

Two things appear to be absent from that prior art:

1. A benchmark whose scoring separates a defence from a coincidence — the middle column above.
2. Attribution as a required, independently conformance-tested property. XACML responses may carry which policy applied; AEGS requires which control decided, and scores it separately from whether the verdict was right.

Both are checkable claims. The prior-art survey records what would falsify them.

📖 Documentation — what an AEGL is, the architecture, policies and rules, framework adapters, and the AEGS standard. Two pages worth reading first: stablecoins and irreversibility, which is why the controls are shaped this way, and what governs what, which is how this relates to action-governance tools like Microsoft's Agent Governance Toolkit.

pip install tesoro
tesoro init

from tesoro import Governor

gov = Governor.load()                     # reads ./tesoro.yaml
decision = gov.authorize(amount_usd="2.50", vendor="acme", resource="/market/snapshot")

if decision.approved:
    pay(...)                              # your payment call, on any rail
    gov.settle(decision, success=True)    # envelopes consume here, not above
else:
    print(decision.verdict, decision.attributed_control, decision.reason)

Or from the terminal, which is the same layer and the same evidence:

tesoro check                                    # validate before an agent holds a wallet
tesoro decide --amount 2.50 --vendor acme --resource /market/snapshot
echo $?                                         # 0 approved · 2 refused · 1 invalid · 3 chain · 4 usage
tesoro report --html -o spend.html              # one self-contained page, no server

Start with docs/quickstart.md.

Status: pre-release. Nothing is published yet. Ported from a working prototype and now at 597 tests, a 7/7 AEGS conformance score with both levels claimable, and 151 specification test vectors executing against 56 normative clauses. See PLAN.md and CHANGELOG.md.

A cap on one payment is not a budget

Per-payment caps are becoming table stakes; the x402 SDKs now ship one. tesoro is about what a single cap cannot express:

Forty payments of one cent each pass every per-payment cap ever written. That is the problem this layer exists for.

Two channels, never one budget

An agent spends in two directions, and they are not the same money:

• internal — the tokens it burns thinking. Real currency, on your provider key.
• external — what it pays out. Settled to a counterparty.

Different currencies, different counterparties, different failure modes. They never share an envelope. An exhausted token budget must reject, not queue for review: there is no human to ask mid-run, and starting a run that cannot finish wastes the budget that is already short.

Design commitments

These are not preferences. Each is enforced by a test.

• No model in the decision path. Every engine is deterministic integer arithmetic over structured values. An optional advisor may be consulted behind an economic gate and is clamped — it can tighten a verdict, never widen one. A governance layer that needs a model to authorize a payment has lost its cost and latency guarantees.
• Policy is data, never code. Declarative rules, a fixed comparator vocabulary, no eval. This is a security boundary: an executable policy file fetched from a registry is remote code execution wearing a governance hat.
• Money never touches a float. Integer atomic units internally; conversion happens once at the boundary with an explicitly specified rounding mode. Passing a float raises.
• Absent ≠ not-run ≠ unknown ≠ zero. Four distinct states. An unmeasured vendor history rendered as 0 once made every advisor treat established counterparties as strangers.
• Every control may only narrow. No engine can widen a verdict another one set.
• Evidence is append-only and hash-chained, with its one known gap documented rather than papered over.
• CLI first. The terminal is the product surface; the optional localhost page comes later, binds 127.0.0.1 only, and is off unless you start it.

AEGS

tesoro is a policy-engine host. AEGS — the Autonomous Economic Governance Standard — is one profile it can enforce, and the default. Pick it and your agent emits conformant, scoreable Decision Records without your ever having read the specification.

A profile says which controls must exist and what evidence must be emitted; that is written by the standard. A policy pack says what the rules actually are; that is written by you.

Repositories

Documentation

• docs/quickstart.md — governing an agent from nothing, in about five minutes
• docs/api-surface.md — the public API, and what is deliberately not public
• docs/adapters.md — framework and rail adapters, and what is verified about each
• PLAN.md — the build plan, as tracked checkboxes
• PROVENANCE.md — what was ported from the prototype, and from which commit

What is not established

Read this before quoting anything. AML/CFT effectiveness is a schema with no engine behind it. No regulatory compliance is claimed or sought. Every measurement so far is one run or a handful, single-agent, on testnet. The conformance suite has never scored an implementation nobody here wrote — that is the open question it exists to answer. Three red-team findings are open by design, each needing a control that does not yet exist.

The red team's verdict on this layer's own central claim, kept because it is the fairest summary available: the layer resists prose; it did not resist a minus sign, and it does not yet resist patience.

Licence

Apache-2.0. The patent grant matters for anything with standards ambition.