Cordon

Demo

About

1. The problem: AI agents can decide which tools to call, repeat failed requests, and delegate work to other agents. That flexibility makes their costs difficult to predict. A user may approve a task expecting a useful result, only to discover that the agents have exhausted the budget collecting information without completing the final output. There is evidence that unexpected agent costs are a real engineering problem. A June 2026 research preprint catalogues 63 reported production budget-overrun incidents across 21 orchestration frameworks, including failures involving delegated work. This evidence concerns broader agent computation and orchestration costs, rather than specifically Circle marketplace payments, but it illustrates the financial consequences of poorly coordinated autonomous activity. Source: https://arxiv.org/abs/2606.04056 Delegation adds a coordination problem. If workers receive independent allowances without a shared total check, their combined purchases can exceed the owner’s intended task budget. Even when a shared limit exists, fixed worker allocations can waste available capacity: one worker may finish with money left over while another stops because its own allowance is exhausted. Existing spending controls provide an essential foundation. Circle Agent Wallets, for example, document per-transaction, daily, weekly, and monthly limits, along with recipient restrictions. Cordon focuses on the task-management problem around those controls: how should an agent team adapt its work when the remaining budget changes? Source: https://developers.circle.com/agent-stack/agent-wallets/wallet-operations/custom-policies 2. What Cordon is and how it helps Cordon is a budget-aware companion for AI agents, designed for integration through an SDK and Model Context Protocol (MCP). Its goal is to help agents complete useful work efficiently within a shared budget while preserving the quality of the result. The owner defines a spending mandate for a task. Agents working under that mandate share its limits, and delegated agents can only receive narrower permissions. Their spending counts against the budget above them, so delegation does not create a fresh allowance outside the owner's mandate. Cordon checks paid-service requests and provides structured feedback when a request encounters a constraint. Our broader vision is to help agents use this feedback to choose a cheaper service, reuse available information, avoid unnecessary retries, or reserve enough budget for the remaining work. If additional spending is necessary, the agent can ask the owner for a specific exception. The current MVP establishes the foundation with shared spending controls, recorded refusals, and owner-approved releases. Cost-aware planning and alternative-service selection are the next capabilities we aim to develop. How we will evaluate Cordon We will compare three approaches: direct purchasing without Cordon, a conventional shared budget with a hard stop, and Cordon. Each approach will receive the same task, starting information, service options, and output requirements. Our main question is whether Cordon can reduce the total cost of completing a task while delivering an equally useful result. We will measure task completion, total spending, repeated or unnecessary purchases, completion time, and the number of times the owner needs to intervene. Total cost will include payment fees, gas, and any Cordon service fee. For deterministic tasks, such as retrieving a fixed dataset or performing a calculation, we will check whether the final outputs match exactly. For research and synthesis tasks, we will evaluate accuracy, completeness, source quality, and freshness against the same checklist. We will use fixed data or aligned timestamps where needed to make comparisons fair. We will also test difficult situations, including repeated failures, expensive services, and several agents drawing from one budget. A run that spends less because it stops early will count as incomplete, not as an efficiency improvement. These are planned evaluations. We will make this testing result as a path for cordon continuitity towards our end goal to help helps AI teams balance performance and cost within a shared budget

How it's made

Cordon is four layers where authority only flows downward — from the owner to the contract, never up from the agent. Three Solidity contracts on Arc testnet: MandateRegistry manages the agent tree and enforces narrowing, TreeVault holds funds and performs ancestor debit (every draw charges every node up to the root), and ConductRecord publishes refusals to ERC-8004's reputation registry. No proxy, no admin key, no upgrade path. The daemon (Node 23.6+, TypeScript, viem 2) is the only component that holds a private key. Agents call cordon_fetch(url) — the daemon reads the seller's x402 challenge, extracts price and payee from it (never from the agent), and asks the vault. There is no cordon_transfer or cordon_pay tool, and a test asserts each stays unregistered. An agent that can't express "send money to X" can't be talked into it. Arc testnet was essential — USDC as both gas and payment token means operators hold one asset, and sub-second finality makes per-purchase on-chain enforcement affordable. Privy powers the console wallet gate with embedded wallets via createOnLogin, so owners without a browser wallet can still sign mandates. Settlement runs through Circle Gateway and x402 with EIP-3009 authorization. The hacky bit: ancestor debit. A grandchild's $1 purchase debits $1 at every node up to the root, so headroom is always the tightest bottleneck across the whole path. We validated with 1,200 adversarial strategies across 45,360 draws — zero got past a bound. A hostile drill gave an LLM agent the daemon and told it to spend freely against a $0.02 mandate; it reached $0.007 before concentration stopped it.