Mandate and spend limits
Per-action caps, velocity windows, approved counterparties, delegation depth. An action outside its mandate never reaches your settlement path.
Every agent payment, authorized before it settles.
Your platform signs one proposed action. Tiberian returns allow, block, or human approval, with an attestation bound to it.
Tiberian sits above the standards agents already transact on.
- Tool call interceptor
- x402Evaluated before settlement
- Trusted agent payload
- Shared payment token
- AP2Mandate contract
Controls that decide before the money moves.
Enforced inside the evaluate call, not written down as guidance.
Policy you can rehearse
Versioned policies run in observe mode against live traffic, scoring without deciding, until you promote them.
Human approval, routed
A review decision opens a case carrying the control it needs, down to fresh confirmation from a finance approver.
Evidence that holds up
Every decision lands in a per-tenant hash-chained audit trail, with a signed attestation bound to that exact action.
Every platform sees one leg of the trip.
Agents are starting to buy APIs, move money, and call tools across platforms that cannot see each other. Visa, Stripe, AP2, x402 and wallets each supply payment, identity or mandate signals. None of them gives every participant a view of agent behaviour across platforms.
x402 seller
402 Payment Required
Two purchases, both inside the mandate it was given.
ALLOWResolved aloneWallet
eip155 addresses
One stablecoin transfer, under the limit it was given.
ALLOWResolved aloneMCP tool host
Tool call interceptor
One transfer call it holds a valid delegation for.
ALLOWResolved alone
| Time | Agent | Venue | Action | Amount | Resolved | Codes |
|---|---|---|---|---|---|---|
| 14:22:07 | agent_local_927 | x402 | purchase_api_access | 12.00 | ALLOW | - |
| 14:22:19 | agent_kx4_118 | mcp | transfer_funds | 15.00 | ALLOW | - |
| 14:22:31 | agent_local_927 | wallet | settle_stablecoin | 48.00 | ALLOW | - |
| 14:22:44 | agent_local_927 | x402 | purchase_api_access | 12.00 | REVIEW 73 | SHARED_WALLET_CLUSTER COMMON_CONTROL_CLUSTER COORDINATED_AGENT_CLUSTER |
The same agent, inside its mandate on every platform it touched. Three correct local allows, then one refusal only the network could reach. Prints above the rule are illustrative; the refusal is read from the published benchmark.
Identical attacks. The only variable is whether platforms share the graph.
Both arms run the same attack code against the same seeded traffic. Siloed, every coordinated attack is a locally correct allow. Networked, the same actions cross a tenant’s own risk threshold. Reproduce it with make benchmark.
Platforms isolated
Every attack a locally correct allow
0/4
Graph shared
The same actions cross the threshold
4/4
coordinated agent cluster
missedREVIEW 73split-limit evasion (fiat/stablecoin)
missedBLOCK 87circular flow / reputation ring
missedREVIEW 69confirmed-fraud propagation
missedBLOCK 91
No benign evaluation was flagged in either arm, across 120 sampled, which bounds the true false-positive rate at 2.5% with 95% confidence.
One round trip, before anything settles.
Sign
The platform builds an Agent Integrity Envelope naming the agent, who controls it, what it is allowed to do, and what it proposes to do. Ed25519 over a canonical form. Unknown fields are rejected.
agent.sign(envelope)
Evaluate
Tiberian verifies the signature and delegation chain, applies the participant's versioned policy, and scores deterministic local and network signals into one risk number.
POST /v1/evaluate
Enforce
Back comes ALLOW, BLOCK or REQUIRE_HUMAN_APPROVAL with stable reason codes and a short-lived attestation bound to this exact action. Move the amount or the counterparty and it stops verifying.
result.allowed
Report
The platform reports what actually happened. One report is an allegation. Two independent participants corroborating turns it into a signal strong enough to block.
report_outcome(id, ...)
Envelope, mandate and delegation integrity findings cannot be overridden, suppressed, or turned into an allow. Everything else is the participant’s to tune, including running a new policy in observe mode against live traffic before it decides anything.
Correlation without a single shared identifier.
A participant benefits from network intelligence without seeing another participant’s raw events, identities, customers, or transaction details.
Nothing crosses a tenant line in the clear
Each participant keeps a private layer holding its exact identifiers. The shared layer is the same neighbourhood re-expressed as domain-separated HMAC tokens. Two participants that independently observe the same wallet write to the same network node, and neither ever compares a raw value.
Matching names prove nothing
Tenant-local agent, principal and counterparty ids are never correlated just because their text happens to match. Only a wallet address, a key or credential fingerprint, or a consent-issued link token can bridge two participants.
One report is an allegation
A single participant reporting fraud can open a review, never a block. Only after a second independent participant corroborates does the signal carry enough weight to block, weighted by a contributor reputation prior. The reporter is never named.
Two participants, one node, no shared identifier
The only cross-platform correlation mechanism there is.
Participant A
0xb41c9e2f…
Participant B
0xb41c9e2f…
Network node
ntk_7f3d1a8c…
Neither participant learns the other’s value, or that the other is even present. The shared node is the only thing they have in common, and it is not reversible.
Every integration does the same three things.
Sign a proposed action into an envelope, evaluate it against the network, and act on the decision. The Python SDK needs three dependencies. The TypeScript SDK needs none.
from tiberian_sdk import TiberianClient client = TiberianClient("https://api.tiberian.dev", api_key="ain_live_...")agent = client.provision_agent("agent_local_927", principal_pairwise_id="principal_8f72") # Build, sign, and evaluate in one call.result = agent.evaluate({ "type": "purchase_api_access", "target_system": "x402", "counterparty_id": "seller_55", "amount": 1200, "currency": "USD", "resource": "api://market-data/premium",}) if result.allowed: charge_the_wallet() client.report_outcome(result.evaluation_id, "success")A blocked action raises 402. A review-required action raises 202. Both carry the decision, the reason codes, and the case id. A cross-language fixture pins both SDKs and the server to byte-identical canonicalization, so if either side drifts, a test fails.
The signal only exists between platforms.
Correlation happens on a shared graph that holds no raw identifier from anyone. That is the whole mechanism, and it is the part a neighbouring product cannot truthfully copy.
Nothing crosses in the clear
Each participant keeps its exact identifiers private. The shared layer holds only domain-separated HMAC tokens.
The node is not reversible
Two participants observing the same wallet land on the same token. Neither learns the other's value, or that the other is there.
The reporter is never named
One report opens a review. Only a second independent participant makes it strong enough to block.
Shipped and measured, not described.
No customer count, no volume, no uptime figure. Those would be invented. These are the numbers the repository can prove about itself.
- 281
- Python tests passing
- 52
- TypeScript SDK tests
- 25
- Tables under forced row-level security
The network gets sharper every time a platform joins.
Tell us what your agents do and how much they move. We will size the integration and get you a participant key.