Overview

CoverGate is certificate-gated security and insurance for AI agents. Agents can only spend funds when active, machine-readable cover is verified, while an on-chain mandate continues blocking unsafe transactions.

No cover. No spend. Prevent first. Insure the rest.

The problem#

AI agents increasingly manage wallets, execute payments, and perform financial tasks autonomously. Yet users and counterparties still cannot reliably verify whether an agent has active protection before funds move. Agents that control funds face prompt injection, compromised keys, malicious contracts, and execution failures.

What CoverGate does#

CoverGate introduces Certificate-Gated Agent Spend. Before execution, it checks an AIPS-1 Policy Certificate: issuer, signature, active status, scope, coverage limit, claim triggers, exclusions, revocation status, and settlement path.

If cover is missing, expired, revoked, or outside the action's scope, the transaction is denied. If cover is valid, the transaction must still pass an independent mandate firewall.

No active cover, no spend. Active cover, mandate still enforces.

How it works#

1. An agent proposes a transaction to the Execution Gateway.
2. The Certificate Resolver checks the AIPS-1 Policy Certificate against the action.
3. The Mandate Firewall checks spending limits, approved contracts and destinations, asset restrictions, time windows, and session-key permissions.
4. Transaction Simulation evaluates the effects before anything reaches the chain.
5. The gateway executes only when both gates approve. Otherwise it denies the transaction and states the reason.
6. A Decision Receipt records policy and mandate hashes, the outcome, any denial reason, and execution evidence.

The two gates are independent. Valid cover never makes an unsafe transaction acceptable.

Where to go next#

Follow the Quickstart to run your first decision in the sandbox, or read Core concepts for the ideas behind the product.