How Warns decides

Before your agent signs a payment, the guard sends Warns the payment request it received and what your agent meant to buy. Warns answers with a decision, and the guard acts on it.

Three outcomes

Outcome	What happens in Protect mode
Allow	The guard lets the signer sign this exact payment, and nothing else.
Review	Nothing is signed. The payment waits in Reviews until someone approves or denies it.
Block	Nothing is signed. The call throws, with the reasons.

Every decision comes with its reasons: a code and a sentence, like DESTINATION_CHANGED, "api.vendor.com usually gets paid at a different address". You find them in the error your code catches, and in Transactions.

Monitor and Protect

Each agent has a mode, which you switch in Agents.

Monitor: Warns computes the real decision and records it, but does not enforce it. Your agent pays as it did before, and the dashboard shows what would have happened: Would allow, Would hold, Would block. No review is opened and no budget is used.
Protect: the decision is enforced. An allowed payment carries a signed attestation, which the guard checks before it lets the signer sign.

Start in Monitor on real traffic, read what Warns would have stopped, then switch to Protect.

On Base mainnet, Warns runs in Monitor only during early access: an agent that pays there gets a decision for every payment, and an alert when Warns would have held or blocked one, but nothing is ever stopped. Protect is open on Base Sepolia and Arc testnet.

In Protect, the guard only pays what it can check: USDC with the exact scheme and an EIP-3009 authorization, and an authorization that stays valid 120 seconds at most. In Monitor, a payment it cannot check goes through as it would without Warns, reported as not evaluated. See Errors and limits.

How the outcome is chosen

Some reasons always block: a frozen agent, a wallet that is not registered on the agent, a network or asset Warns does not support, a payment request that claims to come from another site than the one that served it, an authorization that would stay valid too long, a payment that would go to an address where funds are lost.
The other reasons each add to a risk score from 0 to 100. By default a score of 60 holds the payment for review and 80 blocks it.
Your policies apply on top: caps and budgets block, a payment outside a schedule is held, and rules can hold, block or trust.

The most restrictive outcome wins.

What Warns checks

Code	When it shows up
`AMOUNT_OVER_INTENT`	The merchant asks more than the `expectedMaxUsd` your agent declared.
`AMOUNT_ABOVE_ACTION_CAP`	Above the per payment cap of one of your policies. Blocks.
`BUDGET_EXCEEDED`	The payment would push an hourly, daily or weekly budget over its limit. Blocks.
`NEW_DESTINATION`	First payment to this address for this merchant.
`DESTINATION_CHANGED`	A merchant you already paid asks to be paid at a different address.
`DESTINATION_IS_PAYER`	The merchant asks to be paid at the wallet that pays. Held on first contact, blocked for a merchant you already paid.
`DESTINATION_UNSPENDABLE`	The payment would go to the zero address or to the token contract itself, where funds are lost. Blocks.
`PRICE_BASELINE_OUTLIER`	Far above what this endpoint usually charges you.
`DUPLICATE_PURCHASE`	The same payment was already made in the last minute.
`AUTH_WINDOW_TOO_LONG`	The authorization would stay valid longer than your signer allows. Blocks.
`REDIRECT_CROSS_ORIGIN`	Your request was redirected to another site, which is the one asking for payment.
`CONFUSABLE_ORIGIN`	The merchant's hostname imitates another one with lookalike characters.
`RESOURCE_ORIGIN_MISMATCH`	The payment request names another site than the one that served it. Blocks.
`PAYER_NOT_REGISTERED`	The paying wallet is not registered on this agent. Blocks.
`AGENT_FROZEN`	The agent was frozen, by you or after a payment that skipped Warns. Blocks.
`POLICY_REVIEW_REQUIRED`	One of your policy rules asks for a review.
`POLICY_BLOCK_RULE`	One of your policy rules blocks the payment.
`GATEWAY_CONTRACT_MISMATCH`	A Circle Gateway payment names another contract than Circle's GatewayWallet. Blocks.
`GATEWAY_DEPOSIT_ABOVE_CAP`	A deposit into Circle Gateway is above your cap, 50 USD by default. Blocks.
`OUTSIDE_SCHEDULE`	The payment falls outside the schedule of one of your policies. Held, or blocked if the policy says so.

You may also meet UNSUPPORTED_NETWORK, UNSUPPORTED_ASSET, SCHEME_NOT_ALLOWED, UNSUPPORTED_PROTOCOL_VERSION, ACTION_REPLAYED, FINGERPRINT_MISMATCH and UNKNOWN_EXTENSION. They mean the payment request is outside what Warns can check, or was tampered with.

What Warns learns over time

Two checks depend on your own history, so they get sharper as your agent pays.

Destinations. The address a merchant gets paid at is learned from the first payment that goes through. Before that, a swapped address is only a NEW_DESTINATION. After it, the same swap is a DESTINATION_CHANGED, which holds the payment.
Prices. The usual price of each endpoint is learned from your settled payments. PRICE_BASELINE_OUTLIER needs about twenty of them before it can fire. Until then, your caps and the intent your agent declares are what catch a price spike.

Confidence

Each decision also carries a confidence from 0 to 100: how much Warns knows about the merchant and the address it asks to be paid at, from its own history and from public sources. It is separate from the risk score, so a low confidence means "little is known", never "suspicious". The evidence list says what Warns knows, for example that you already paid this address several times.

Confidence does not change the outcome today. It is there so you can see, on each payment, how well known the other side is.

Test and live

Each workspace has two environments, switched at the top of the dashboard. Agents, keys, policies, decisions and history are separate in each. A key belongs to one of them, and says so: warns_test_... or warns_live_....

Each environment pays on its own networks: test on Base Sepolia and Arc testnet, live on Base mainnet. A live key never moves testnet money by mistake, nor a test key real money. The network you pick for a new agent decides its environment.

Next: The traps