Agentic Risk Standard
ARS is t54's research project for agent underwriting, evidence, escrow, and settlement safety.
Agentic Risk Standard (ARS) is a t54 research project focused on trustworthy AI agent transactions. It studies how agent jobs can be represented as signed events, how delivery can be evaluated, how fees can be escrowed, and how high-risk principal movement can be protected by underwriting.
ARS is research infrastructure rather than a commercial product surface. It informs Trustline's underwriting direction by exploring a formal model for evidence, settlement, role separation, liability boundaries, and dispute handling. The related paper is available on arXiv: Agentic Risk Standard.
Research Problem
When a human or institution delegates work to an AI agent, both sides need guarantees. The requestor needs confidence that the work will be delivered. The agent or merchant needs confidence that it will be paid. If the task involves moving principal or creating financial exposure, both sides need a mechanism for underwriting, collateral, evidence, and dispute resolution.
This problem becomes more acute as agents move into institutional finance. Treasury, DeFi, and trading workflows can benefit from faster execution and lower operational overhead, but the institution still needs to know which actor carried authority, which policy governed the job, and who bears responsibility after a failed or disputed outcome.
ARS approaches this accountability problem through an event-sourced protocol. Every action is a cryptographically signed event appended to an immutable log. Job state is derived by replaying the event log rather than mutating a central state object. This makes the lifecycle auditable and tamper-evident.
Settlement Tracks
ARS defines two settlement tracks.
| Track | Purpose |
|---|---|
| Fee track | Used by every job. A fee is locked in escrow, work is delivered, an evaluator issues a pass or fail verdict, and funds are released or refunded. |
| Principal track | Used for higher-risk or fund-moving jobs. An underwriter assesses risk, may require premium or collateral, and gates principal release behind evidence and policy. |
The principal track is especially relevant to Trustline because it turns agent underwriting into an explicit protocol problem. Risk assessment is not an informal comment attached to a transaction. It becomes part of the lifecycle that determines whether funds can move, what collateral or premium may be required, and how responsibility is handled if the job fails.
Roles
ARS separates roles so that a single agent does not silently control every part of the workflow.
| Role | Function |
|---|---|
| Requestor | Creates the job, signs agreements, locks fees, pays premiums, and can accept override paths. |
| Business Agent | Performs the work, signs agreements, submits deliverables, requests underwriting, and locks collateral when required. |
| Evaluator | Reviews delivery quality and issues pass or fail verdicts. |
| Underwriter | Assesses principal risk and sets premium or collateral requirements. |
| Settlement Layer | Executes release, refund, slash, or principal movement according to protocol state. |
This role separation is one of the strongest links between ARS and Trustline. Production underwriting needs clear boundaries between the user, the agent, the merchant, the risk evaluator, the underwriter, and the payment rail. Without those boundaries, agentic finance can become efficient while making accountability weaker. ARS studies how to avoid that failure mode.
AP2 And Verifiable Intent Implementations
The ARS repository includes concrete implementations that map the abstract protocol into AP2 and Verifiable Intent contexts.
In AP2-ARS, AP2 mandates provide the authorization layer. Intent, cart, and payment mandates describe what the user authorized, what the merchant offered, and how payment is approved. ARS then provides the settlement tracks that make the transaction safer after authorization.
In VI-ARS, Verifiable Intent credential chains provide cryptographic authorization evidence. ARS keeps the event-sourced settlement lifecycle while VI handles issuer-backed intent, selective disclosure, and credential presentation.
This distinction is important for Trustline's product strategy. Intent credentials and payment mandates are not enough by themselves. The system also needs underwriting, evidence handling, settlement receipts, liability-aware role separation, and outcome feedback.
Relationship To Trustline
ARS informs Trustline in three ways.
- It provides a formal model for signed, replayable evidence.
- It treats underwriting as part of the transaction lifecycle rather than an external afterthought.
- It clarifies how agent authorization protocols such as AP2 and Verifiable Intent can coexist with risk, escrow, and settlement controls.
The product lesson is that agentic finance needs a durable record of who authorized what, who delivered, who evaluated, who underwrote the risk, and what happened at settlement. Trustline carries that lesson into production risk and underwriting workflows.