Agent Duke Protocol: Safety-as-a-Service for Autonomous Multi-Chain Systems

Decentralized networks now settle a material share of programmatic economic activity, and an increasing proportion of that activity is initiated by autonomous software rather than by human operators. The prevailing security model for these networks — periodic audit, manual review, and post-settlement analytics — was constructed for human-paced execution on a small number of homogeneous chains. It does not extend to continuous, cross-chain, agent-initiated execution.

This paper introduces the Agent Duke Protocol, a Safety-as-a-Service system that provides continuous validation, autonomous enforcement, automatic network onboarding, and evidence-grade forensic reconstruction across heterogeneous decentralized networks. The protocol positions a deterministic decision layer between the originators of action and the networks that execute it. Each submitted action is normalized into a chain-agnostic representation, evaluated against network state and declarative policy, permitted, constrained, or interdicted before settlement, and recorded as a signed attestation.

We describe four cooperating subsystems: a Multi-Chain Validation Engine that unifies evaluation semantics across networks; a Sentinel Layer that enforces policy and executes interdiction autonomously; Universal Chain Discovery that identifies, classifies, and onboards new networks without bespoke engineering; and a Forensic Intelligence Suite that converts operational telemetry into defensible evidence. Together these define security as an always-available service rather than a periodic deliverable.

Three simultaneous shifts have invalidated the assumptions underlying existing decentralized security practice. First, execution has become multi-chain: a single economic operation may originate on one network, route through a bridge, and settle on another, with no single system holding a complete view. Second, execution has become autonomous: agentic software now originates transactions continuously, in volumes and at latencies that exceed any human review capacity. Third, settlement remains irreversible: once finality is reached, remediation is a legal and forensic exercise rather than a technical one.

The consequence is a structural control gap. Audits certify code at a point in time but say nothing about the behavior of the systems calling that code a month later. Monitoring products detect anomalies but detect them after settlement. Chain-specific tooling produces fragmented coverage in which the weakest-covered network defines the effective security posture of the whole. Institutions that would otherwise deploy autonomous systems into production therefore face an unresolved governance obligation.

Agent Duke addresses this gap by relocating security from the periphery to the execution path. Rather than observing what has occurred, the protocol participates in whether an action occurs at all. This requires three properties that existing approaches do not jointly provide: machine-speed decisioning, uniform semantics across networks, and reproducible, exportable evidence for every decision rendered.

The mission of the Agent Duke Protocol is to make autonomous activity on decentralized networks verifiably safe. The protocol exists so that any system — human-operated or autonomous — can act across any network with the assurance that its actions have been validated against current state and explicit policy before settlement, that violations will be interdicted without human intervention, and that a defensible record of every decision will exist afterward.

4.1 Security is a service, not an artifact. Protection must be continuously available and callable at the moment of action. Coverage that lapses between review cycles is not coverage.

4.2 Prevention precedes detection. Because settlement is irreversible, the protocol optimizes for interdiction before finality rather than notification after it.

4.3 One grammar for all chains. Networks differ in execution semantics, but policy intent does not. Normalization into a common representation is a prerequisite for uniform coverage.

4.4 Determinism and reproducibility. Given the same inputs, policy version, and observed state, the protocol must return the same decision. Non-deterministic security cannot be audited.

4.5 Evidence as a first-class output. Every decision emits a signed, exportable record containing the policy applied, the state observed, and the reasoning path. Forensic capability is an operating property, not an incident-time project.

4.6 Autonomy proportional to threat. The protocol acts independently at machine speed and escalates to human operators only when a decision exceeds its delegated authority, and then only with a complete evidence package.

4.7 Coverage must expand automatically. Security that requires manual onboarding for each new network will always trail the ecosystem. Discovery and classification are therefore protocol functions rather than operational tasks.

4.8 Developer legibility. Integrators must be able to determine why any decision was reached. Opaque enforcement is indistinguishable from unreliable enforcement.

The protocol assumes an adversary with full visibility into public network state, the ability to deploy contracts, the ability to originate transactions at machine speed, and the ability to influence the inputs consumed by autonomous agents. It does not assume control of the integrator's signing infrastructure or of the protocol's policy store; compromise of either is treated as a containment problem addressed by default-deny behavior and revocation.

5.1 Malicious contract behavior. Contracts whose observable interface differs from their executed effect, including upgradeable proxies mutated after review, conditional logic keyed to caller identity, and delegated calls that relocate control.

5.2 Counterparty risk. Addresses associated with prior theft, sanctions exposure, mixing behavior, or coordinated clusters whose relationship is visible only in aggregate across networks.

5.3 Agent subversion. Prompt-injected, misconfigured, or compromised autonomous systems that issue technically valid transactions inconsistent with their delegated authority.

5.4 Cross-chain evasion. Operations decomposed across networks so that no single chain-specific monitor observes an amount, counterparty, or pattern that would trigger a control.

5.5 Economic manipulation. Oracle distortion, liquidity manipulation, and ordering attacks that render an otherwise valid action harmful at execution time.

5.6 Coverage gaps. Newly launched networks and execution environments that are unmonitored simply because no operator has onboarded them yet.

The protocol is organized as a control plane and an execution path. The control plane holds policy, network registries, threat intelligence, and the evidence store. The execution path comprises ingestion, normalization, validation, enforcement, and attestation, and is traversed by every submitted action.

6.1 Ingestion. Actions arrive through the protocol API, an SDK, an agent middleware binding, or a signing gateway. Each carries the originator identity, the declared intent, and the candidate transaction payload.

6.2 Normalization. Chain-specific payloads are translated into a canonical action representation describing originator, target, value movement, invoked behavior, and settlement network. Policy is written against this representation rather than against any network's encoding.

6.3 State acquisition. The engine resolves the network state relevant to the action: contract bytecode and upgrade status, counterparty history, liquidity and oracle conditions, and prior actions by the same originator.

6.4 Subsystems. The Multi-Chain Validation Engine, Sentinel Layer, Universal Chain Discovery, and Forensic Intelligence Suite operate as peers over the canonical representation and share a single evidence pipeline.

6.5 Failure semantics. Loss of control-plane connectivity results in default-deny for actions exceeding locally cached authority. Availability is never purchased by permitting unvalidated settlement.

Validation is a deterministic function of the canonical action, the observed state, and the pinned policy version. It proceeds in ordered stages, and the first stage that produces a terminal verdict ends evaluation.

7.1 Structural validation. Encoding, target existence, parameter conformance, nonce and replay conditions, and fee viability.

7.2 Behavioral simulation. The action is executed against a forked network state to derive its actual effect — balance deltas, ownership and permission changes, external calls, and emitted events — rather than its declared effect.

7.3 Counterparty evaluation. Every address touched by the simulated effect is scored against attribution data, sanctions and abuse lists, and cross-chain cluster analysis.

7.4 Economic evaluation. Slippage, oracle deviation, liquidity depth, and value-at-risk are bounded against policy thresholds.

7.5 Authority evaluation. The originator's delegation envelope is checked: permitted networks, contracts, counterparties, value ceilings, and rate limits.

7.6 Verdict. The engine returns permit, constrain, or interdict, with a confidence value, the identifiers of every rule evaluated, and the reasoning path that produced the outcome.

The Sentinel Layer converts verdicts into effects. Enforcement is synchronous with the execution path so that no interdicted action reaches settlement.

8.1 Permit. The action proceeds, and a signed attestation records the state and policy under which it was allowed.

8.2 Constrain. The action proceeds only in modified form — reduced value, tightened slippage bounds, altered routing, or a required additional approval. The original and modified forms are both recorded.

8.3 Interdict. The action is refused before signing or broadcast. Where a signing gateway is in use, refusal is structural rather than advisory.

8.4 Escalation. Decisions exceeding delegated autonomy suspend the action and notify human operators with a complete evidence package rather than an alert.

8.5 Posture adjustment. Repeated violations, anomalous baselines, or active incident conditions automatically raise enforcement strictness for the affected originator, contract, or network.

8.6 Revocation. Authority can be withdrawn globally in a single policy operation, propagating to every connected network and every local enforcement point.

Forensic capability is produced by normal operation. Because every decision is recorded with its inputs, reconstruction does not depend on retrospective data collection.

9.1 Reconstruction. Incidents are rebuilt as ordered timelines spanning every network involved, including the actions that were interdicted and never settled.

9.2 Attribution. Addresses are clustered by funding paths, timing correlation, contract deployment lineage, and cross-chain bridge behavior.

9.3 Propagation analysis. The movement of value after an event is traced through bridges, mixers, and exchange deposits, with confidence annotated at each hop.

9.4 Reporting. Output is generated in formats intended for internal audit, insurer review, regulatory disclosure, and law-enforcement referral, with the underlying evidence referenced rather than summarized.

Coverage that requires manual onboarding will always trail the ecosystem. Universal Chain Discovery makes onboarding a protocol function.

10.1 Identification. Candidate networks are detected from registries, bridge endpoints, client gossip, and observed settlement references in existing traffic.

10.2 Classification. Each network is profiled by execution environment, consensus and finality characteristics, address and encoding format, and available node interfaces.

10.3 Adapter synthesis. Where a network conforms to a known execution family, a normalization adapter is instantiated from that family's template, and differences are expressed as parameters rather than bespoke code.

10.4 Qualification. A network enters observation-only status until simulation fidelity, state availability, and finality behavior meet defined thresholds, at which point enforcement is enabled. Policy already written applies immediately, with no per-network authoring.

Policy is declarative, versioned, and expressed against the canonical action representation, so a single statement of intent applies uniformly to every connected network.

11.1 Structure. A policy binds a subject (an originator, agent, service, or organizational unit) to conditions over the canonical action and to an effect of permit, constrain, interdict, or escalate.

11.2 Composition. Policies compose hierarchically from organization to unit to individual agent. Conflicts resolve to the most restrictive effect; silence resolves to deny.

11.3 Lifecycle. Policies are authored as code, reviewed, versioned, and promoted through environments. Every decision references the exact version applied.

11.4 Simulation. Proposed changes are replayed against historical action streams to quantify how they would have altered prior outcomes before they take effect.

11.5 Delegation. Authority envelopes for autonomous agents are policy objects with their own expiry, scope, and revocation semantics.

The evidence model exists so that a decision rendered at machine speed can be defended years later by a party who was not present when it was made.

12.1 Record contents. Each attestation contains the canonical action, the observed state references, the policy version and rules evaluated, the reasoning path, the verdict, the enforcement effect, and a monotonic timestamp.

12.2 Integrity. Records are signed and chained, so any alteration or omission within a sequence is detectable by an independent verifier.

12.3 Reproducibility. Because validation is deterministic, a record can be replayed against its referenced state and policy version to confirm that the same verdict is produced.

12.4 Custody and retention. Access, export, and retention are governed explicitly, preserving chain of custody for audit, insurance, and legal use.

12.5 Cryptographic durability. Attestations support hybrid classical and post-quantum signatures so that records remain verifiable across the full retention period.