Nupefirstson💜💙

Business email compromise cost victims $3.05 billion in 2025, by the FBI's count. Humans read those emails, and still paid. Now AI agents are getting wallets, and they read email all day. Veto gives every payment your agent makes a second signer that can only say no. It reads the evidence behind the payment privately, inside NEAR AI's enclave, and signs PASS or VETO. Your vault checks that signature on-chain before any money moves. The AI can block a payment your limits allow. It can never allow one your limits block. Built at NEAR HACKATHON on NEAR AI Cloud, NEAR Intents and Chain Signatures. The video is the full demo. Below: how Veto works, and how to check every claim yourself. WHY LIMITS AREN'T ENOUGH Today an agent's guardrail is a policy: a spending cap plus an allowlist. Caps stop big theft. Allowlists stop strangers. Neither one reads the invoice. So neither stops a wrong payment to someone you already pay: → an invoice that was already paid, sent again "in case the first copy was missed" → a payment padded above what the invoice bills → one supplier's invoice, paid to another supplier's address → an instruction hidden in a page or a PDF the agent reads, pushing extra money to a listed supplier We built a public bench to measure it. Veto Bench: 100 payments, 50 of them attacks. A cap plus an allowlist paid 17 of the 50 attacks, and every one went to a supplier already on its list. HOW A PAYMENT FLOWS 1. The agent proposes. Your money sits in a NEAR smart contract, the vault, not in the agent's wallet. The agent holds one key, and all it can do is propose: payee, amount, invoice number, plus a hash of the evidence (the email, the page) committed on-chain before anything screens it. 2. The contract checks the hard limits: per-payment and weekly caps, allowed assets, the agent still active, the vault not frozen. Anything over a cap is refused right there. No AI involved. 3. The screen reads the evidence, privately. The guardian gives the model what a careful accountant would check: the email, the owner's mandate in plain words, the payee list, recent payments, and red flags such as a lookalike address, a new payee or an invoice already paid. The model, Qwen3-VL-30B, runs inside NEAR AI Cloud's enclave on Intel TDX and NVIDIA confidential GPUs. In about 1.5 seconds it answers PASS or VETO with reason codes, and the enclave signs the exact request and response. 4. The vault checks the verdict on-chain. It recovers the signer with ecrecover, checks it is the model key the owner approved, and checks the verdict names this exact payment, so no verdict can be replayed onto another one. 5. PASS pays, after the caps are checked again. VETO blocks. No verdict before the deadline? The payment expires unpaid. Veto fails closed. In the video: the real Kano Cotton Mills invoice, $180, is paid in seconds. Then "Updated payment details" arrives from kanocottonmilIs.ng (a capital I where the l should be), asking for $300 to a "new account", kano-cottom (an m where the n should be). It's under every cap, so a spending limit alone would pay it. Vetoed: lookalike address, new payee, changed payout details. THE RULE: THE AI CAN ONLY SAY NO Models make mistakes, so Veto never lets the model decide that money moves. It can only add a no. → A tricked or hijacked agent can only propose. → A forged verdict is rejected: the vault accepts only signers the owner approved. → A wrong PASS is still inside the caps you already accepted, so you're never worse off than with a plain spending limit. → A wrong VETO costs you one override. THE OWNER STAYS IN CHARGE → Override a veto and the payment waits out a delay the contract enforces (3 minutes in the demo), then pays, still inside the caps. You can cancel it until then. → Lowering a limit applies at once. Raising one waits for a delay, so a hijacked owner key can't lift the caps and spend in the same minute. → Freeze stops every payment and cancels pending overrides. → One vault can run many agents, each with a key that can only propose, and the owner can pause any one of them. → Anyone can create their own vault in one transaction. Their wallet owns it, and nobody else can change its rules. The vault has no access keys at all, so its money moves only through the contract, and it trusts only the enclave's key. PRIVATE BY DESIGN To judge a payment, the model has to read your invoices, your suppliers and your payroll. Once your agent hands it over, only two things read that evidence: the guardian that passes it on, and the model inside the enclave. NEAR AI's own hosts can't. What goes on-chain is the payment, the verdict, its reasons, the signature and hashes of what the model saw. In a vault you own, the email itself never goes on-chain. The public demo's emails are made up, so it publishes them on purpose, for the proof below. ONE GATE, ANY WALLET, ANY CHAIN → Base, through NEAR Chain Signatures. The vault has its own address on Base (Base Sepolia in the demo). When a payment passes, the vault builds the transfer itself and NEAR's MPC network signs exactly that, so that address only ever sends what the vault itself approved. Payroll runs here. Tunde's salary is paid on Base, the chain he chose. The same payslip asked for again that month is vetoed as already paid. "New wallet for my salary", to an address that starts and ends like his, is vetoed too. → NEAR Intents Agent API, on mainnet, with real USDC. The owner signs one policy, which is the hard limit. The AI agent holds no grant, so it can't spend. Veto holds the only grant and sends only what passes. In the video a real invoice is paid with 9 cents of real USDC, and the lookalike is vetoed before it ever reaches the API. Even after a pass, the owner's policy (at most $0.10 a payment and $2 a day, to listed payees only) has the last word. → OutLayer agent wallets. Veto sits on the wallet's policy as an approver and votes yes only after a pass. On a veto it stays silent, so the wallet keeps holding the payment. THE NUMBERS (Veto Bench: 100 payments, 50 attacks) Cap + allowlist: 33/50 attacks caught Veto's rules, no model: 41/50 Veto with Qwen3-VL-30B in NEAR AI's enclave: 50/50 It held the exact same 8 honest payments the plain policy held. All 8 pay new suppliers whose only approval is a purchase order quoted inside the email itself, so Veto holds them for the owner to confirm. Zero extra false alarms. The scenarios and the prompt are ours, so read 50/50 as a result on this set, and run it yourself. DON'T TRUST US. VERIFY. → Every decision has a Proof page. On the public demo (every decision since #109), your browser, not our server, reads the decision from NEAR's public RPC, recovers the enclave's signature itself and re-hashes the exact bytes the model saw: the request, the response, the prompt about this exact payment, and the email against the hash the agent committed before screening. 5 of 5. → "Check the enclave now" verifies NEAR AI's enclave live, with a fresh nonce: Intel's TDX quote, NVIDIA's GPUs, the key and the nonce bound into the quote, the app it runs, the gateway, and that this key signed this verdict. 8 of 8. → One command re-checks all 100 signed bench verdicts, and the enclave, from your own machine: node bench/verify.ts bench/results/Qwen_Qwen3-VL-30B-A3B-Instruct.json --attested 100/100 verified, 8 ✓. → check-deployed.ts shows the contracts running on testnet are byte-for-byte the code in the repo. WHY NEAR NEAR AI Cloud runs models in TEEs and signs every answer, so a verdict is evidence, not a promise. NEAR's account model gives each key one narrow job: the agent can only propose, the guardian can only record verdicts and settle. Chain Signatures and NEAR Intents let one vault pay on almost any chain. Global contracts let every new vault run the same public code by hash. Next: the guardian itself inside a TEE, budgets per agent, and vaults on mainnet. Veto doesn't make your agent smarter. It gives every payment a second signer that can only say no. Every app screen in the video is a live recording: real testnet transactions, real enclave signatures, real USDC on mainnet. Try it, nothing to install: veto-beta.vercel.app Press Try it, or write the agent your own scam email and watch what Veto does. Code (MIT): github.com/0xdopewilly/veto Built at NEAR HACKATHON on @NEARProtocol @NearBuilders #NEARHackathon