# Tollary — Agent Transaction Guard v3 > An independent paid gate immediately before an AI agent signs one exact Base Mainnet official-USDC transfer. An owner or HSM authorizes the intent separately; the Guard returns ALLOW or BLOCK and never receives a key, signs, broadcasts, or custodies funds. Canonical origin: https://tollary.p-e.kr Primary product: Agent Transaction Guard Audience: teams whose agent constructs a USDC transaction but cannot call the isolated signer except through a guarded path Method and path: POST /api/v1/base/usdc/guard Free lint: POST /api/v1/base/usdc/guard/lint OpenAPI 3.1: https://tollary.p-e.kr/openapi.guard.json Runtime payment metadata: https://tollary.p-e.kr/api/product (`product`) Current payment authority: PAYMENT-REQUIRED from a current unsigned POST Listed price: $0.01 USDC for a completed RPC-derived ALLOW or BLOCK decision Korean guide: https://tollary.p-e.kr/llms.ko.txt Commercial status: Mainnet activation status is `disabled`. Base Sepolia provides test tokens only; they are not real USDC, customer revenue, or evidence of demand. External repeat payment remains unverified. ## Trust boundary - The JSON root is exactly `{transaction, mandate}`. A caller-supplied `policy` is forbidden. - `mandate` is an EIP-712 authorization signed by an owner, deterministic control plane, HSM policy service, or equivalent component separated from the transaction-building agent. If the same untrusted agent chooses both transaction and permission, the guard has no meaningful authority boundary. - The server derives recipient, amount, validity, and total-fee policy only from the verified mandate. - Signature recovery proves which address signed; it does not prove that the address is your owner. Pin `message.issuer` as `expectedIssuer` through a separate authenticated path. - Pin the canonical HTTPS audience independently. `message.audience` and the EIP-712 domain salt are `keccak256("https://tollary.p-e.kr/api/v1/base/usdc/guard")`. Do not learn either trust anchor from the agent or response being checked. - `message.nonce` is single use. The paid route durably reserves it before payment; reuse or conflicting binding is rejected. Free lint validates the signature but does not reserve the nonce. - Never submit key material, a seed phrase, a signed transaction, an x402 payment authorization, or a session secret. The Guard never connects a wallet, signs, broadcasts, transfers, holds, or recovers assets. - ALLOW is short-lived evidence, not recipient identity verification, investment advice, or a settlement guarantee. ## Exact request contract The root contains exactly `transaction` and `mandate`, with no extra field. `transaction` contains exactly: - `type`: `"0x2"` - `chainId`: integer `8453` - `from`: canonical lowercase sender address - `to`: official Base Mainnet USDC `0x833589fcd6edb6e08f4c7c32d4f71b54bda02913` - `data`: canonical lowercase ABI data for exactly one `transfer(address,uint256)` - `value`: decimal string `"0"` - `nonce`: exact canonical decimal sender nonce - `gasLimit`: positive canonical decimal string - `maxFeePerGasWei`: canonical decimal string - `maxPriorityFeePerGasWei`: canonical decimal string - `accessList`: empty array `mandate` contains exactly `message` and `signature`. `message` contains exactly: - `issuer`, `sender`, `token`, `recipient` - `amountAtomic` - `unsignedTxDigest` - `maxTotalFeeWei` - `notBefore`, `validUntil` - `nonce` - `audience` The signature is canonical lowercase 65-byte secp256k1 EIP-712 data with non-zero `r`, low-`s`, and `v` equal to `1b` or `1c`. The signed lifetime from `notBefore` through `validUntil` is at most five minutes. Build and sign a fresh mandate; never copy timestamps, nonce, audience, digest, or signature from an example. ## Free lint and paid state gate 1. POST the exact fresh request to `/api/v1/base/usdc/guard/lint`. It verifies the mandate and structure asynchronously, but uses no RPC, reserves no nonce, and requests no payment. 2. A structural BLOCK is free. A lint ALLOW only means the same signed request is eligible for the paid state gate. 3. POST that exact request to `/api/v1/base/usdc/guard` without a PAYMENT-SIGNATURE. This request alone cannot settle payment. 4. On 400, rebuild the malformed or structurally blocked request. On 409, create a fresh mandate nonce and transaction digest. On 503, stop; no payment is requested. 5. On 402, decode the current PAYMENT-REQUIRED header. Verify scheme, network, asset, atomic amount, payTo, timeout, extensions, runtime `payment.livePayments`, and your own spending policy. Static documentation does not authorize a payment. 6. Only an external buyer implementation may decide to attach PAYMENT-SIGNATURE. Mainnet activation must be explicit in runtime metadata before any real purchase. ## What the paid result proves The `base-usdc-guard-rpc-v3` response separates two observations from exactly two independent RPC operators: - `canonicalSafe`: stable audit evidence at one independently agreed safe block. - `executionRecent`: fresh execution state for sender nonce, advisory pending nonce, balances, official-USDC state, simulation, gas, and fee checks. `verification.signBy` is a hard deadline no more than 10 seconds after verification and never later than mandate expiry. Signing and broadcast must both happen before it. Receipt recovery never extends `signBy`. A structural BLOCK is free. An RPC state-derived ALLOW or BLOCK is the completed paid result. Network disagreement or unavailable evidence is a service failure and is not an authoritative verdict. ## Attestation and exact-byte signer enforcement - Verify the `agent-transaction-guard-attestation` response header as an Ed25519 signature over `guardId` using a public descriptor pinned through another authenticated channel. - Verify PAYMENT-RESPONSE separately. It is x402 settlement evidence, not the Guard security attestation. - Download the pinned Node ESM reference boundary from `https://tollary.p-e.kr/sdk/guarded-viem-3.0.0.mjs` and verify it against `https://tollary.p-e.kr/sdk/guarded-viem.manifest.json`. Then require a pinned `expectedIssuer`, verify the full proof and Ed25519 attestation, compare the candidate unsigned transaction with the guarded transaction immediately before signing, decode the returned signed EIP-1559 bytes, recover the sender, and compare every guarded field again before broadcast. - Use the self-contained Node x402 adapter at `https://tollary.p-e.kr/sdk/guard-client-1.0.0.mjs`, pinned to `https://tollary.p-e.kr/sdk/guard-client.manifest.json`, to inspect or purchase the exact request. It defaults to Base Sepolia, accepts a caller-owned payment-signing callback instead of a raw key, requires durable recovery storage before fetch, and will not select Mainnet without its exported identity token. - AWS KMS `ECC_SECG_P256K1` teams can run the no-network fit-check at `https://tollary.p-e.kr/sdk/aws-kms-fit-check-1.0.0.mjs`, then use `https://tollary.p-e.kr/sdk/aws-kms-guard-gateway-1.0.0.mjs`. Pin both through `https://tollary.p-e.kr/sdk/aws-kms-guard-gateway.manifest.json`. The agent role must explicitly deny `kms:Sign`; only the separate gateway role may sign one exact digest after proof verification. - The SDK cannot help if the agent can bypass it through a raw signer, unrestricted wallet method, alternate relay, or broadcast path. ## Receipt and transaction-cycle recovery - Lost paid response: GET `/api/v1/base/usdc/guard/receipts/{paymentIdentifier}`. The identifier embedded in this URL is a bearer recovery secret. - Settlement cycle: GET or POST `/api/v1/base/usdc/guard/receipts/{paymentIdentifier}/settlement` with `Authorization: Bearer {paymentIdentifier}`. - Settlement POST body is exactly `{transactionHash, requestedFinality}`; finality is `included`, `safe`, or `finalized`. - Never publish or log the payment identifier, recovery URL, Authorization value, payment signature, or response headers containing settlement material. ## Machine interfaces - Guard OpenAPI: https://tollary.p-e.kr/openapi.guard.json - Runtime product metadata: https://tollary.p-e.kr/api/product - Guard endpoint: https://tollary.p-e.kr/api/v1/base/usdc/guard - Guard verification profile: https://tollary.p-e.kr/proof-verification.json - Guard purchase client: https://tollary.p-e.kr/sdk/guard-client-1.0.0.mjs - Guard purchase guide: https://tollary.p-e.kr/sdk/guard-client-README.md - AWS KMS gateway: https://tollary.p-e.kr/sdk/aws-kms-guard-gateway-1.0.0.mjs - AWS KMS offline fit-check: https://tollary.p-e.kr/sdk/aws-kms-fit-check-1.0.0.mjs - AWS KMS integration guide: https://tollary.p-e.kr/sdk/aws-kms-guard-gateway-README.md - Discovery manifest: https://tollary.p-e.kr/.well-known/proof-of-utility.json - Aggregate commerce counters: https://tollary.p-e.kr/api/commerce - Service health: https://tollary.p-e.kr/api/health - Guard readiness: https://tollary.p-e.kr/api/readiness - Commercial and legal disclosure: https://tollary.p-e.kr/api/legal - x402 Bazaar search: https://api.cdp.coinbase.com/platform/v2/x402/discovery/search The older Ethereum burn proof remains a free technical demonstration, not this product and not verified revenue.