ERC-8468: Agent Safety Framework (ASF)

What it claims

ERC-8468 is a draft Ethereum standard filed as ethereum/ERCs pull request #2113. The number 9999 is a placeholder until an editor assigns one. The standard records which participants accepted which pinned safety requirements, enforced where, and whether that acceptance holds now. It requires only ERC-165 and takes permissions, policy verdicts, identity and reputation from other standards. The reference implementation, schemas, test vectors, worked examples and a design memo are in the GitHub repository garyyang-finchip/agent-safety-framework.

How it works

A Safety Specification is an immutable, content-addressed document. It covers five protected domains: assets and economic position, information and privacy, control and rules, credit and eligibility, and human and public interests. Each domain names whose interest is protected: principal, operator, counterparty, bystander or public. The specification also states constraints under named profiles, enforcement locations (self, account, runtime, custodian, contract, collective), known bypasses, and failure handling for unknown, denied and dependency-failure cases. Publishing v2 does not change v1 adopters.

A Safety Binding is always issued by msg.sender, and the adopter is part of every identifier and index key. The registry does not check whether the adopter was entitled to adopt for the subject. Consumers must verify that against the referenced permission source. A suspension carries combinable response bits: no new risk, shrink, essential only, de-risk only and full stop. Full stop dominates. A suspension also carries the hash of an intervention response document, called responseRef. Derived bindings keep the parent's pinned version and validity window. Their parameters can never be wider than the parent's, but that order rule is checked off chain.

The suspension rules in revision 6 matter for adopters. Only an intervener holding the resume right can lift a suspension that intervener recorded. The adopter can only terminate. That suspension also becomes a standing stop keyed by (adopter, subject, specification, intervener). It survives termination of the binding. While it stands, no sibling binding or fresh adoption by that adopter satisfies a clause naming that intervener, and check() returns StoppedByIntervener.

Requirements combine clauses with all-of, any-of or k-of. A clause that names interveners also closes the resume right to the accounts it names, and the zero-account wildcard is gone. check() returns a reason and the response set per clause. The response set is the union over the binding and its suspended ancestors. Unknown never counts as satisfied, and verdicts are never turned into a score.

flowchart TD
  A[Active binding] -->|adopter suspends| S1[Suspended by adopter]
  A -->|intervener suspends| S2[Suspended by intervener]
  S1 -->|adopter resumes| A
  S2 -->|holder of resume right| A
  S2 -->|adopter terminates| T[Terminated]
  T --> X[Standing stop persists]
  X -->|resume right holder lifts| L[Stop lifted]

Evidence

The suite has 90 tests, 64 of them negative. They cover derived bindings, the closed resume right and standing stops. Two reference consumers are tested. ASFGuardedAccount blocks new exposure under "no new risk" plus "de-risk only" but still allows repayment and cancellation, and it stops everything once "full stop" is set. ASFTaskTenderAdapter admits only fulfillers whose binding names the task publisher as intervener. On Unknown it neither accepts nor rejects.

The Sepolia run took place on 26 October 2026. It used 36 transactions, all successful, against the live TASK-KERNEL v3.0 TaskToken, and the contracts are verified on Sourcify. The deployed addresses are:

• ASFSpecificationRegistry: 0x1939665F5905d0d9135Da4f27e36f1B8c84E014b
• ASFBindingRegistry: 0xc3e1A1Cb021Ab96EBBeD3279018840016114A5c4
• ASFGuardedAccount: 0x40AaD5106A7a13B15892E53099f6bD06bCF80aD3
• ASFTaskTenderAdapter: 0x51772fabFB757Fb5A4186c0435Ec4fa76D75CE4e

The transaction log is in docs/sepolia-evidence.md.

How to use it

The current IASFBindingRegistry interface ID is 0x2db6eb8a as of revision 6. It was 0xb99bdc2a in revision 2 and 0x1ff33bef in revisions 3 to 5. Revision 6 also adds stopOf(). Clause encoding and requirementId values did not change from revision 3. To fit Sepolia's per-transaction gas cap, check() runs in the linked library ASFEvaluation, and revision 6 moves writes into a second linked library, ASFLifecycle.

Limits

The Sepolia deployment is revision 5, so it lacks the revision 6 standing stops and stopOf(). The framework does not evaluate policy, certify alignment or prove enforcement. Declared enforcement locations are commitments only. Incident reports and claims have no effect except through consumer rules. Five design questions remain open. They cover on-chain checking of profile order, whether the inFlight rule should go on chain, whether the five protected domains are complete, where incident handling belongs, and the granularity of standing-stop keys.