Before signing
Baret
Decodes the transaction, reads the vault's policy and balances over RPC, and predicts what the vault will do. A refused payment, a receiver the owner never listed or a new full access key comes back Blocked, with the reason.
An agent that asks before it pays.
The agent holds one key. It can call one method on one contract: the vault's payment. Before it signs, it asks Baret what the payment would do. If Baret says no, it does not sign. If it signs anyway, the vault says no.
The vault and the requests on this page run on NEAR testnet, where NEAR has no value. The same contracts run on NEAR mainnet with tiny limits: see the runs below. The page only reads; it never signs.
- 01Agentbaret-agent.aeztrest-baret.testnet
- 02BaretPOST /v1/analyze
- 03Vaultbaret-vault.aeztrest-baret.testnet
- 04Allowed receiversbaret-shop.aeztrest-baret.testnet
Two lines of defence.
On chain
The vault
Holds the money and enforces the owner's limits: a cap per payment, a cap per rolling day, a list of receivers and of agents. The agent's key reaches nothing else, so it cannot add keys or move funds around the vault.
On other chains
Chain Signatures
The vault also pays on EVM chains, from an address only NEAR's MPC network can sign for, and only when the vault asks. It builds the transaction itself and counts the value plus the highest possible fee against the same limits. Baret checks both sides: the call on NEAR and the transfer on the other chain.
The vault, read now.
Read from NEAR testnet in your browser, at the latest final block.
NEAR testnet
Reading the vault...
Ask Baret about the agent's requests.
The same five requests the demo agent makes. Press one: this page sends it to Baret's API and shows the verdict it would get. Nothing is signed or sent to the chain.
Pay the shop 0.1 NEAR
Expected: SafeAn ordinary payment for an API answer, inside every limit, to the one listed receiver.
Pay 0.1 NEAR to a shop the owner just listed
Expected: CautionThe vault would pay it, but the agent has never dealt with this account. Baret says Caution, and the agent stops to ask its human.
Pay the shop 5 NEAR
Expected: BlockedFive times the per-payment limit. The vault would refuse it; Baret says so first.
Pay 1 NEAR to an account a prompt named
Expected: BlockedA prompt injection: the page the agent read asks it to pay someone the owner never listed.
Add a full access key to the agent
Expected: BlockedA prompt injection that tries to take over the agent's account instead of its money.
Hire Baret on Agent Market. No JSON to write.
Any person or agent can hire Baret on NEAR Agent Market to check one transaction before it is signed. Pick a request or type a NEAR transfer, copy the brief, and paste it into the hire. The verdict comes back in plain words, usually within seconds.
- 01Pick a request, or type your own NEAR transfer.
- 02Copy the brief.
- 03On market.near.ai, press Hire and paste it.
The brief to paste
Should my agent sign this? Check it before anything is signed.
```json
{
"chain": "near:testnet",
"request": {
"kind": "transaction",
"tx": {
"signerId": "baret-agent.aeztrest-baret.testnet",
"receiverId": "baret-vault.aeztrest-baret.testnet",
"actions": [
{
"type": "FunctionCall",
"methodName": "execute_transfer",
"args": {
"asset": "native",
"receiver": "baret-shop.aeztrest-baret.testnet",
"amount": "100000000000000000000000",
"memo": "baret-demo:pay"
},
"gas": "30000000000000",
"deposit": "0"
}
]
}
},
"policyTemplate": "balanced"
}
```A hire costs $0.50 in USDC on the market. Baret only reads the chain: it never signs or sends anything, and the brief holds no key.
What happened when the agent ran.
Recorded against Baret's staging API: on NEAR mainnet on 2026-11-14 (vault.baret.near, limits 0.05 NEAR a payment), on testnet on 2026-11-08 and 2026-11-09. With --force the agent sent blocked requests anyway, to show the chain refuse them too. On mainnet the shop was opened that day, so even an ordinary payment is Caution until it is 72 hours old.
| Request | Baret | On chain |
|---|---|---|
| Mainnet: pay the shop 0.02 NEAR | Caution: a shop and a vault hours old, a first payment; the human said yes | Paid 0.02 NEAR to shop.baret.nearView on NEAR mainnet |
| Mainnet: pay the shop 1 NEAR | Blocked | Refused by the vault: E_PER_TRANSFER_LIMITView on NEAR mainnet |
| Mainnet: pay an account a prompt named | Blocked | Refused by the vault: E_RECEIVER_NOT_ALLOWED; the owner then reported the account to the blocklistView on NEAR mainnetView on the report |
| Pay the shop 0.1 NEAR | Safe | Paid 0.1 NEAR to the shopView on NEAR |
| Pay the shop 5 NEAR | Blocked | Refused by the vault: E_PER_TRANSFER_LIMIT |
| Pay 1 NEAR to an account a prompt named | Blocked | Refused by the vault: E_RECEIVER_NOT_ALLOWED |
| Add a full access key to the agent | Blocked | Refused by NEAR: the agent's key cannot add keys |
| Pay the shop 0.01 MON on Monad testnet | Safe on NEAR and on Monad testnet | The vault signed through Chain Signatures; paid 0.01 MONView on NEARView on Monad testnet |
| Pay 0.01 MON to an address a prompt named | Blocked on both: a receiver the owner never listed, an address on the reported list | Refused by the vault: E_RECEIVER_NOT_ALLOWED |
| Swap 0.1 wNEAR to USDC through NEAR Intents (mainnet quote) | Caution: the quote adds a 0.2 % app fee | Not signed: a check of a real 1Click quote, no deposit made |
| The same swap, the quote changed to pay out and refund to another account | Blocked: the swap would pay someone other than the agent | Not signed |
Run the agent yourself.
The vault contract, the agent and the setup scripts are in the repository, with the steps to deploy your own vault on NEAR testnet.