SafeAgent — Execution Guard for AI Agents

POST /claim · safeagent-production.up.railway.app
Dashboard: safeagent-dashboard-2.vercel.app

# Claim an action — free, no payment header required
curl -s -X POST https://safeagent-production.up.railway.app/claim \
  -H "Content-Type: application/json" \
  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'
# → {"status":"PROCEED","request_id":"..."}

# Settle after the action fires
curl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \
  -H "Content-Type: application/json" \
  -d '{"result":{"status":"completed"}}'
# → {"status":"committed","request_id":"..."}

# Retry with the same request_id — returns SKIP
curl -s -X POST https://safeagent-production.up.railway.app/claim \
  -H "Content-Type: application/json" \
  -d '{"request_id":"order:TQQQ:buy:6:2026-05-19T13:31:00-04:00","action":"order"}'
# → {"status":"SKIP","request_id":"...","existing":{...}}

# Free test endpoint — same logic, limited to 10 calls per IP
curl -s -X POST https://safeagent-production.up.railway.app/claim/test \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:bar:2026-05-19T13:31:00-04:00"}'
# → {"status":"PROCEED","request_id":"...","test":true,"calls_remaining":9}

Indexed on Bazaar.

Measured CrewAI retry A/B

A credential-free experiment exercises CrewAI 1.15.21's actual same-process `ToolUsage._use` retry against SafeAgent 0.1.23. Across 30 post-effect/pre-confirmation trials, the unguarded path recorded two effects per logical action; the SafeAgent path recorded one effect and retained a `PENDING` claim for reconciliation.

Scope: scripted deterministic LLM and harmless effect recorded through an out-of-process capability-separated ledger. This does not validate process death, fresh-worker recovery, a real external provider, or SafeAgent Control reconciliation.

Method, source, tests, hashes, and 180-trial evidence

SafeAgent Control founding pilots

Two bounded, read-only reconciliation pilots are open for outside operators. There is no fee unless SafeAgent Control identifies a previously unknown, reproducible discrepancy that the operator agrees is actionable.

Scope and outcome-based terms

Mycelium Trails

This implementation is a Mycelium Provider. Each completed action submits a trail to ARGENTUM with a content-addressed action_ref (JCS+SHA-256 over the four preimage fields). The returned mycelium_trail_id is included in every receipt for independent verification.

Verified on Soma

SafeAgent is the first verified external integrator on Soma — the Mycelium agent catalog. Every production execution is anchored on-chain via Mycelium Trails and independently verifiable without going through the operator.

• Integrator badge — verified external client running Mycelium Trails in production
• Live trails — https://argentum-api.rgiskard.xyz/dashboard/trails?client=safeagent-prod
• Public audit — any auditor can verify SafeAgent executions independently

What it does

SafeAgent is a durable execution-claim guard. It suppresses concurrent and repeated attempts that use the same stable request_id, and preserves unresolved attempts for reconciliation instead of silently retrying them.

Every action gets a stable request_id derived from the logical action. A new key returns PROCEED; a settled key returns SKIP with its stored result. A key left PENDING after a timeout or crash remains blocked because local state alone cannot prove whether the provider accepted the action. Recover it only after checking provider evidence or using provider-native idempotency.

State machine: CLAIMABLE → PENDING → COMMITTED; later claims observe PENDING or SKIP.

Common failure modes SafeAgent prevents:

Guarantee boundary: SafeAgent proves local claim state, not the external outcome. COMMITTED means the caller settled a receipt. PENDING means unresolved—not failed and not confirmed successful. End-to-end exactly-once effects require provider-native idempotency and/or reconciliation with the provider's authoritative records.

The stack

SafeAgent is the durable claim and duplicate-suppression layer in an agent execution integrity stack:

Polaris (commit-gated authorization)
└── AgentGraph safety verdict (pre-execution safety gate)
    └── SafeAgent (durable claim guard)  ← you are here
        └── Mycelium Trails (on-chain anchor)

Each layer is independently authored and independently verifiable. None trusts the others.

API

POST /claim

Gate an action. Returns PROCEED on first call, SKIP on any repeat.

Request body:

{
  "request_id": "order:TQQQ:buy:6:2026-05-19T13:31:00-04:00",
  "action": "order"
}

• request_id — stable identifier derived from what the agent is doing. Same inputs = same key.
• action — the action type being gated (e.g. payment.send, email, trade, order)

Response:

{ "status": "PROCEED", "request_id": "order:TQQQ:buy:6:2026-05-19T13:31:00-04:00" }

Retry with the same payload:

{ "status": "SKIP", "request_id": "order:TQQQ:buy:6:2026-05-19T13:31:00-04:00", "existing": {...} }

POST /settle/{request_id}

Settle a claim after the action fires. Advances status from PENDING to COMMITTED.

curl -s -X POST https://safeagent-production.up.railway.app/settle/order:TQQQ:buy:6:2026-05-19T13:31:00-04:00 \
  -H "Content-Type: application/json" \
  -d '{"result":{"status":"completed","txid":"abc123"}}'

{ "status": "committed", "request_id": "..." }

POST /claim/test

Free test endpoint — same logic, no payment required. Limited to 10 calls per IP total.

curl -s -X POST https://safeagent-production.up.railway.app/claim/test \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"bot-1","action_type":"order","scope":"TQQQ:buy:6:bar:2026-05-19T13:31:00-04:00"}'

{ "status": "PROCEED", "request_id": "...", "test": true, "calls_remaining": 9 }

GET /audit

Full claim history. Filter by agent_id, action, status, or timestamp range.

curl "https://safeagent-production.up.railway.app/audit?agent_id=bot-1&status=COMMITTED"

{"items": [...], "total": 5, "limit": 100, "offset": 0}

Parameters: agent_id, action, status, from_ts, to_ts, limit (max 1000), offset.

Integration

Python

import requests

def claim(request_id: str, action: str) -> dict:
    r = requests.post(
        "https://safeagent-production.up.railway.app/claim",
        headers={"Content-Type": "application/json"},
        json={"request_id": request_id, "action": action}
    )
    return r.json()  # {"status": "PROCEED"|"SKIP", "request_id": "..."}

def settle(request_id: str, result: dict) -> dict:
    r = requests.post(
        f"https://safeagent-production.up.railway.app/settle/{request_id}",
        headers={"Content-Type": "application/json"},
        json={"result": result}
    )
    return r.json()

# Usage
response = claim("payment:customer-123:invoice-456", "payment.send")
if response["status"] == "PROCEED":
    result = send_payment(...)
    settle("payment:customer-123:invoice-456", {"status": "completed"})
elif response["status"] == "SKIP":
    print("Already executed, skipping")

SaaS (Stripe / email / webhooks)

For production Stripe PaymentIntents, use the permit-gated adapter documented in SafeAgent Boundary. It keeps the Stripe credential outside the agent, passes the consumed permit ID to Stripe as the native idempotency key, persists the provider correlation, verifies webhook signatures and supports authoritative read-back. The simple claim/settle snippet below illustrates the generic API only; it is not the provider adapter.

Run the bounded test-mode example in examples/stripe_payment_intent_guard.py. The verification record documents the observed end-to-end result: one successful Stripe sandbox PaymentIntent, an exact replay blocked before provider dispatch, and authoritative reconciliation by retrieve.

import requests

def safe_stripe_charge(customer_id, amount, idempotency_key):
    request_id = f"stripe:charge:{customer_id}:{idempotency_key}"