An agent with a wallet will eventually be told to do something it should not: by a user, by a poisoned web page, by a customer email. Today its limits are a system prompt, or an if in the same process the model steers. Neither can be checked by anyone else afterwards, and neither stops the transaction once the agent decides to send it anyway.
Chancela is the layer that decides what an agent may do, and proves it. The agent asks before it acts. A deterministic policy engine, never the model, answers with a signed permission bound to the exact parameters. Every decision, refusals included, is a transaction on Monad that anyone can verify without an account.
A per-order and per-day limit a prompt injection cannot move, and a record their users can check.
Accept orders from agents without trusting the agent: an order without a grant for exactly that call reverts.
Show each owner what their agent was allowed to do, and what it tried.
Every team writes the first version: an if before the tool call. What they do not write, because it only matters after something has gone wrong:
And the home-grown version has one limit no amount of work removes: nobody outside the company can verify it. A policy hash and a decision anchored on Monad can be checked by a counterparty without asking anyone. The threat model lists eighteen attacks of this kind.
| Path | Effort | What the integrator writes |
|---|---|---|
| HTTP | 1 minute | One POST to /api/agents/:id/authorize before the action. No account, no key. |
| MCP | 2 minutes | A config block with npx -y chancela-mcp. The model gets a chancela_authorize tool. |
| MetaMask Agent Wallet | 2 minutes | The mm-plugin-chancela plugin: mm chancela authorize … && mm transfer … |
| Python | 5 minutes | One file. chancela.guard(agent, "PLACE_ORDER", order, …), verified locally. |
| TypeScript SDK | 5 minutes | chancela.guard(agent, action, params, () => doIt()) runs only if the permission verifies against the on-chain attestor. |
| Self-hosted | 30 minutes | docker compose up. MIT, no call home; point the agent at your own attestor. |
Measured on testnet, one anchored decision is one transaction, 92,478 gas, about 0.009 MON, in sub-second blocks. That is what makes it affordable to record every decision, refusals included, while the agent is still waiting for its answer. On a slower or dearer chain this gets batched into a daily Merkle root and the per-action proof is gone. When a human must decide, they approve with a passkey, and Monad verifies that signature itself through its P-256 precompile.
The protocol is and stays open: MIT code, a registry contract with no admin, and an attestor the agent's owner can replace in one transaction. So what can be sold is not access; it is running the attestor well.
Everything in the repository, forever.
We run the signing key, the anchoring and the monitoring. An anchor costs about 0.01 MON on testnet, which is what makes per-decision pricing possible at all.
A dedicated key and deployment for a platform that hosts many agents, with audit exports for its compliance team.
The constraint we hold ourselves to: nothing in the paid tiers can make an agent dependent on us. An owner who leaves takes their identity, policy history and audit trail with them, because none of it was ever ours.
David Matheus Souza, in Brazil, with a background in infrastructure, support and automation: the side of IT that gets the call when an automated system does something nobody approved. Chancela comes from there. If agents are going to act on their own, the question after an incident is always the same: who allowed this, under which rule, and can you prove it? Today the only answer is the operator's own log. Built alone during the Metropolis build window.