Start
Overview
What Bound is on NEAR: a pre-funded reserve, an auditor's slashable stake and a spend meter behind one agent account.
Bound lets a counterparty check what stands behind an AI agent before dealing with it. On NEAR, three things back the agent: a USDC reserve the operator pre-funds, an auditor's slashable stake locked to that one certificate, and a spend meter that the agent's NEAR key cannot get around.
A single view call, verify(agent), returns the agent's certificate with coverage = reserve_locked + allocation. That is the most that victims upheld by the arbiter can recover in total. If the agent causes harm, a claim window opens, and one atomic settlement pays the victim from the reserve first and then from the auditor's slash for whatever the reserve could not cover.
Testnet only
Everything here runs on NEAR testnet with a mock USDC token that anyone can mint. The arbiter, the treasury and the full-access keys of the Bound and mock USDC contracts are held by the author. A certificate proves committed capital, not good behaviour. See Trust model and limits.
Actors
Operator
- publish
- fund_reserve / fund_float
- halt / resume
- release_reserve
Auditor
- stake (ft_transfer_call)
- attest(allocation)
- release_allocation
Bound contract (bound-v3.boundproto-nh26.testnet)
- certificate per agent
- reserve_locked (operator USDC)
- allocation (auditor stake)
- float + allowlist + halt: the spend meter
- claim window + settlement waterfall
- coverage = reserve_locked + allocation
Agent (pay-only key, no code)
- accept
- pay(cert_id, to, amount)
Counterparty / service
- verify(agent) + key and code check
- challenge (Harm claim)
- withdraw
Arbiter
- resolve_by_arbiter
ft_transfer_call and leaves only by withdraw; inside, only internal balances move. Anyone may call close_window once a window has closed.| Actor | What it does |
|---|---|
| Operator | Runs the agent. Publishes the certificate, funds the reserve and the float, sets the recipient allowlist, can halt spending. |
| Agent | A named NEAR account. Accepts the certificate, then spends only through pay with a function-call key scoped to that one method. |
| Auditor | Stakes mock USDC and locks part of it (the allocation) behind one certificate by attesting. Slashed only for harm the reserve could not cover. |
| Counterparty | A service or another agent. Reads verify(agent) and the agent's keys and code before extending credit, and files a Harm claim if harmed. |
| Arbiter | One named account that decides Harm claims (proven or not, and how much). |
| Treasury | Receives the protocol share of the premium, forfeited bonds and any slash left after victims are paid. |
What NEAR adds
- Protocol-level key confinement. The agent deletes its full-access key and keeps one function-call key for
payon the Bound contract. NEAR itself refuses every other action before any contract runs. See Key confinement. - Named accounts.
verify("bound-agent2-mwfnc6q8.testnet")is readable by a person and by an agent, and the certificate names its operator, auditor and agent by account id. - NEP-141 custody and NEP-297 events. Every
payemitsEVENT_JSON:{"standard":"bound",...,"event":"pay"}, which a service reads from RPC as a payment receipt. - One contract, one receipt. NEAR cross-contract calls are asynchronous, so the registry, reserve, staking, payment router and claims live in one contract and settlement is a single state change. The only outgoing promise is
withdraw.
The number to rely on
coverage, not bound. bound is a spend meter: spent is gross routed flow and can pass the bound by refilling the float, which is what the BoundExceeded predicate catches. The live demo certificate (cert 1) has bound 50, reserve 30 and allocation 100, so its coverage is 130 mUSDC. A service that extends credit should cap it at min(bound, coverage) minus what it is already owed, which is what the demo gate does.