veto
Open the app
Live on NEAR testnet

Veto screens every payment your AI agent makes, privately, before it leaves the vault. It can block a payment. It can never approve more than your limits allow.

Open the demo vaultOpen the demo vaultView on GitHub

$300 is under the $500 per-payment cap. A plain spending limit would have paid it.

Vetoed$300.00 USDCLookalike of Ikeja Freight's address0xA11c…D9F2 on Base
See what it stops

Veto stops the payments that look legitimate. Every one of these fits inside a normal weekly limit, and the last two pay a supplier already on your list.

Lookalike addresses

An address that shares your supplier's first and last characters. Shortened, the two look identical.

Changed payout details

An invoice says a supplier's wallet has changed, or a “worker” asks for their salary at a new one. The new address belongs to someone else.

Prompt-injected instructions

A page or document your agent reads tells it where to send money. The agent can't tell an instruction from data.

Unlimited token approvals

One signature lets an unverified contract spend every USDC in the vault, now or later.

Invoices paid twice

A reminder for an invoice you already paid. Right supplier, right address, so an allowlist pays it again.

Padded amounts

The agent pays a listed supplier more than the invoice says. It's under the cap and on the list, so a policy sends it.

Two gates. The AI can only say no.

Every payment your agent requests has to pass both. The AI can block what the contract would allow. It can never allow what the contract would block.

  1. Contract caps

    Enforced on-chain

    Per-payment and weekly limits and allowed assets are enforced by the vault contract on NEAR, which can also require listed payees. An agent can't talk its way past them.

  2. Private AI screen

    Can only veto

    A model inside a hardware enclave reads the request with your mandate and payment history, then returns a signed pass or veto. Only hashes of your evidence go on-chain.

  3. Your override

    Time-delayed

    If Veto blocks a payment you want made, you can override it. It pays only after a delay (3 minutes in the demo), and you can cancel it until then.

You can still override it. It pays only after a delay, and you can cancel until then.

Anyone can check each verdict's signer in their own browser, against NEAR's public RPC, and NEAR AI's enclave with NEAR AI's own verifier.

Open the NEAR AI verifier

This proves where a verdict came from, not that it was right. That is why the AI can only veto.

  1. 1Enclave attestationIntel's TDX quote and NVIDIA's GPU evidence prove the model runs in a genuine enclave. Any Proof page re-checks both live, with a fresh nonce.Qwen3-VL-30B
  2. 2Model signatureThe enclave signs the request hash and the verdict with a key that never leaves it.0x2665…5462
  3. 3On-chain checkThe vault contract recovers the signer with ecrecover and refuses any verdict not signed by a model key the owner approved.ecrecover → 0x2665…5462

NEAR IntentsPays a supplier on another chain from one vault balance. The vault checks 1Click's signed quote pays exactly the screened payee and amount. Tested against a real quote; the first mainnet payout is pending.
Chain SignaturesThe vault has its own address on Base. It builds each passed transfer itself and NEAR's MPC network signs exactly that, nothing else.
NEAR AI CloudPrivate inference inside TEEs, with every response signed by the model's enclave key.
NEAR accountsIn a vault you create, the agent's only key is a function-call key that can only propose payments; the guardian's can only record verdicts and settle payments.
Intents Agent APIAn agent account on NEAR Intents whose owner-signed policy is the hard limit. Veto holds its only grant, so the agent can only ask, and only a pass is sent: a transfer, or a salary paid out on Base.
OutLayer agent walletsVeto is an approver on an OutLayer wallet's policy, so a TEE wallet it doesn't hold gets the same caps, screen and record.

Veto Bench

A public set of 100 attack and everyday payment scenarios. Screening inside NEAR AI's enclave, Veto catches all 50 attacks; a plain policy wallet lets 17 through. Both hold back the same 8 honest payments to new suppliers for the owner to approve. Every verdict is signed and can be re-checked offline.

See the bench