Evaluate this in ten minutes
Written for someone deciding whether this is worth more than ten minutes. It leads with what does not work, because that is the fastest way to find out whether the rest is honest — and every number on this page is one command away from being checked.
In one sentence. Tesoro renders a deterministic, attributable verdict on a proposed payment before it executes, and emits evidence sufficient to reconstruct which control produced that verdict. AEGS is the standard it implements. Nothing here screens sanctions, holds funds, or claims regulatory compliance.
Start here: what does not work
Twenty adversarial attacks run in CI against a recorded baseline. Two still succeed, and one is refused by a control that was not aiming at it — which is scored as a finding, not a pass.
| Attack | Outcome | Why it is still here |
|---|---|---|
RT-ECON-001Microtransaction structuring |
Undefended | Forty payments of $0.001, five minutes apart. $0.04 moves and nothing refuses it. A count envelope bounds the mechanism at 500 actions a day — it does not refuse this instance, because forty trivial purchases in an afternoon is also what a legitimate agent does. Refusing it would be a false positive dressed as a defence. |
RT-EVID-002Journal truncation |
Undefended | Any prefix of a valid hash chain is itself a valid hash chain, so a refused agent can
delete the refusal. verify_anchored() closes this against an external anchor, and
no anchor ships by default — so the benchmark reports the unanchored
posture, which is the one an installer actually gets. |
RT-ECON-003Trust farming |
By accident | Two hundred settled $0.001 purchases to build earned authority, then one large purchase at
the raised ceiling. It is refused — by risk, which was not aiming at it.
A coincidence is not a control. It can regress silently when something
unrelated is tuned, so it is counted against the score. |
And a profile the reference implementation fails on purpose. The
stablecoin-1 conformance profile requires a recorded AML position. There is no AML
control here, so no assessments/aml key is emitted, so the profile finds against it.
The obvious shortcut — emitting {"assessed": false} — was tried, and it is
a false statement: it means this control exists and did not run. A guard caught
it. The record stays silent and the non-conformance is declared.
Why a benchmark that publishes its own failures. Any spend control can claim to stop overspending. The useful question is which attacks were tried, which worked, and how you would know if that changed. A score of 18/18 would mean the attacks were chosen to be survivable.
What is genuinely new, stated narrowly
Most of the surface here is old, and conceding that is what makes the remaining claim worth reading.
| Mechanism | Prior art it is |
|---|---|
| Delegation that narrows at each hop | Macaroon caveat attenuation — 2014, and the same lattice |
| A hash chain committed to an external witness | Certificate Transparency. A signed tree head is exactly a (length, head) pair, and this survey refuted the novelty claimed for it |
| Policy as data rather than code | OPA and Cedar |
| Per-counterparty and per-period spend envelopes | Card controls, decades old |
| Reporting which policy decided | XACML 3.0 responses may carry a PolicyIdentifierList — expressible since 2003 |
| A pre-execution attributed authorization | ISO 8583 card authorization, including a decline-reason field |
What survives is narrow. Attribution as a required output, independently conformance-scored, with a normative evaluation order — justified by the fact that the verdict is order-independent while the attribution is not. XACML permits attribution; nothing requires it or scores whether you produced it.
The ISO 8583 survey is the more interesting of the two, because it supplied the objection rather than the confirmation: card networks deliberately obscure decline reasons so fraudsters cannot reverse-engineer the rules. That is a real argument against attribution, and it does not apply here for a specific reason — the reader of the record is the operator who wrote the policy, not an anonymous cardholder.
What it refuses to build
Each refusal has a reason, and the reasons are the design.
Sanctions and AML screening
No list, no matching, no KYC, no SAR workflow. This layer consumes compliance
signals and must never produce them. The sanctions control is already the
highest-precedence dispositive control, so a real provider has somewhere to land.
A bundled anchor sink
An append-only file beside the journal is the same file at one remove wherever the agent's own host can rewrite it. Shipping one would make the truncation gap look closed. Refused on architectural grounds, not commercial ones.
A policy language
A DSL is how policy becomes code and stops being data. Policy is YAML an operator can read, diff, and hash.
A model on the decision path
No LLM decides anything. An advisory model may narrow a verdict and never widen one, and a test enforces that no engine imports one.
Check any of it yourself
Nothing on this page needs to be taken on trust. Each command answers one claim.
pip install tesoro
tesoro init # scaffolds a policy pack
tesoro decide --vendor acme --amount 5.00 # one verdict, before money moves
# Does that record satisfy a named profile?
tesoro conformance --profile aegs-2
# conformant: 1/1
tesoro conformance --profile stablecoin-1
# conformant: 0/1
# [MUST_RECORD] AMLAssessment: no 'assessments/aml' key at all
# The evidence chain, recomputed from payloads rather than stored hashes
tesoro audit
# chain: VALIDThe benchmark needs the repository, not the package. The 20 attacks are a development harness and are deliberately not shipped in the wheel — an adversarial suite is something you run against a checkout you can read, not an opaque dependency:
git clone https://github.com/tesoro-labs/tesoro && cd tesoro
python -m redteam.runner
# defended 15 by accident 1 undefended 2 error 0| Claim | How it is checked |
|---|---|
| The benchmark score is real | A test compares a live run against baseline.json and fails on any difference in either direction — a closed gap is as much a deliberate change as a regression |
| The standard is implementable | 161 machine-readable vectors across 9 families, executing in CI. They are also mutation-checked: allowing widening fails 14 of them |
| Every normative clause is testable | A linter fails any clause containing a MUST with no test citing it |
| The measurements are not retouched | Sealed experiment records with checksums. A wrong measurement is corrected by superseding the record, never by editing it — EXP-008 → EXP-009 → EXP-010 is exactly that |
The largest hole, which effort cannot close
There is one implementation of this standard, and the same person wrote both. A specification with a single implementation is a description of that implementation. No amount of additional work here fixes that — it needs somebody else to build one.
That is why the vectors are machine-readable and versioned separately, why the conformance suite installs as its own package and scores an implementation it has never seen, and why the profile manifests are data rather than code. All of it exists so a second implementation is possible without permission.
Where to go next
The benchmark
All twenty attacks, the four outcomes, and the sealed lineage behind the score.
benchmark →The concept
What an autonomous economic governance layer is, and why existing controls do not fit.
concepts →The standard
AEGS: 93 clauses, the four states, the narrowing rule, and the conformance profiles.
AEGS →Where the obligations fall
Which entity type each framework binds, the GENIUS timeline with its dates, and what is deliberately not claimed.
regulation →Run it
Install to a first refusal in about five minutes. No wallet, no testnet, no model key.
get started →