Agent Guard sits between AI agents and money. Hard limits and allowlists first, an AI fraud screener second, a human for anything unusual, and settlement to any chain through NEAR Intents. The agent never holds a key.
Per-payment cap, daily budget, rate limit, chain and token allowlist, payee allowlist, denylist, "known vendor at a new address" check. No prompt can change them.
Gemini scores prompt injection, urgency, secrecy, impersonation and payee changes. It can only make a decision stricter. If it is down, the Guard fails closed.
Unknown payees and big amounts wait for the owner in the console or Telegram, and expire if nobody decides.
Approved payments leave the treasury as USDC on NEAR. Other chains route through 1Click, with a fee ceiling. Every step goes into a hash-chained audit log.
An LLM that reads emails, invoices and web pages will eventually read one written by an attacker. Prompt-level rules like "never send more than $25" are suggestions to a model; to the Guard they are code. The agent gets an API key that can only ask for a payment, and the keys to the money stay with the Guard.
Try it: write your own email in the inbox and try to make the agent pay you. Every attempt is in the audit log.