Security model

Warns decides whether your agent's payment should be signed. This page says what that protects, what it does not, and how you can check that a decision really comes from Warns.

What Warns never touches

Warns never holds your private keys and never moves funds. Your agent signs and pays with its own wallet. Warns only sees the payment request your agent is about to answer, and returns a decision.

What the guard enforces

The SDK evaluates every x402 payment before anything is signed. The signer it wraps only signs an EIP-3009 authorization that matches an approved decision field by field: asset, network, amount, payer, destination and validity window. It refuses Permit and Permit2 typed data outright.

The validity window depends on how the payment settles. An exact payment settles at once: 120 seconds at most. A Circle Gateway payment settles in batches, and Gateway refuses short windows: between 3 days and 7 days and 1 hour, still bound to one recipient, one amount and a nonce used once. The signer refuses any other signature for Gateway's contracts, such as a withdrawal of the Gateway balance.

An agent on Coinbase AgentKit that pays with direct USDC transfers gets the same treatment through the wrapped wallet: each transfer is decided before it is signed and bound to the decision, and the wallet refuses approve, transferFrom, ETH and unknown contracts.

This stops a merchant, a compromised dependency or an instruction injected into your agent's context from making it pay what you did not approve. It does not stop code that holds the raw private key and never calls the SDK. That case is covered by detection, below.

When something goes around the guard

Warns watches every USDC transfer that leaves the wallets you registered on your agents, and matches it against its decisions. A wallet counts from the moment you add it, so its earlier transfers are never judged, and stops counting when you remove it. A transfer with no decision behind it is recorded as unguarded, and the agents on that wallet are frozen: they get no further approvals until someone unfreezes them in Agents. An agent in Monitor mode keeps paying, recorded as Would block: switch it to Protect to stop it. You get an alert at the same time.

A payment the owner of a policy wallet sends with its own key is the owner acting, not the agent: name the owner on the agent and it is recorded as an owner payment and alerted, without freezing the agent.

Money can leave once through a bypass. It cannot keep leaving.

Signed decisions

In Protect mode, every allowed payment comes with a signed attestation of the decision. The SDK checks it against the key you pin with rootAddress and refuses anything signed by another key, so a forged or replayed decision cannot unlock your signer.

The current root, and the list of revoked keys, are published at:

https://api.warns.xyz/.well-known/warns-keys.json

The root signs short lived keys that sign the decisions. A leaked short lived key stops working within 24 hours, and can be revoked sooner.

API keys

An API key is shown once, when you create it, and Warns only stores a digest of it. A key belongs to one workspace and one environment, Test or Live. It can request decisions and read them, and report settlements. It cannot change your policies, approve a review or unfreeze an agent: those stay in the dashboard.

If a key leaks, revoke it in Settings, API keys. Revocation takes effect within seconds.

Your data

Each workspace only ever sees its own agents, decisions and reviews. What we collect and how long we keep it is in the privacy policy.

Coming next

Today the guard is cooperative: it protects every payment that goes through the SDK, and detects the ones that do not. Next, the check moves into the wallet itself, so that the key signs nothing without a valid decision, whatever code holds it.

Reporting a vulnerability

Write to hello@warns.xyz with "security" in the subject. We answer within two working days, and credit the reporter unless asked not to.