SENTINEL · Technical Whitepaper
A SENTINEL Technical Whitepaper Version 1.0 · sentinel-agent.dev · On-chain oracle: 0x6841496c3e7eDF9eEB02bE64ab98CF5D5c5aF813 (Base)
Autonomous agents now transact at scale — independent on-chain trackers recorded over 157 million cumulative x402 settlements across seven chains by mid-2026 — yet they still decide whom to pay using trust signals that do not survive scrutiny. The dominant approach, on-chain reputation assembled from peer feedback, has been shown empirically to fail: a 2026 study of the ERC-8004 ecosystem across three chains found that 59–91% of reviewers exhibit coordinated Sybil behavior, and that after removing Sybil-flagged feedback, up to 86.8% of rated agents have no valid feedback remaining. Reputation-by-review, it turns out, measures mostly noise.
This paper argues that trust for agentic commerce must rest on a different foundation: recomputable behavioral evidence rather than declared reputation. We distinguish two paradigms. In the reputation paradigm, trust is an aggregate of opinions — reviews, ratings, feedback — which are cheap to manufacture and therefore gameable. In the behavioral-evidence paradigm, trust is derived from observed conduct — did the counterparty pay, did it deliver, did its advertised price match its actual charge — recorded as append-only, hash-anchored incidents that any party can independently recompute and verify. The first paradigm asks what do others say about this agent? The second asks what has this agent verifiably done?
We present SENTINEL, a production trust oracle for x402 payment counterparties on Base that implements the behavioral-evidence paradigm. SENTINEL scores counterparties bidirectionally (both payer and payee), issues each judgment as an ES256 attestation verifiable offline against a published key, publishes scores on-chain for smart-contract composability, and — centrally — maintains an append-only Default Registry of verified incidents that grounds every score in auditable evidence. We describe its methodology in full, including three properties that reputation systems structurally cannot provide: non-purchasable maturity, weakest-leg composition, and consequential evidence. We situate this design within emerging theoretical work on recomputable and trust-native systems, and within the regulatory frameworks — Singapore's IMDA governance framework, the EU AI Act, MiCA — that are beginning to require exactly the audit trails SENTINEL produces. We conclude that as the agent economy matures, the trust layer that endures will not be the one with the most scored entities, but the one whose judgments are most defensible.
Autonomous software agents have crossed from demonstration into production commerce. They discover services, call paid APIs, purchase data, and settle transactions without a human approving each step. The x402 protocol — which revives the long-dormant HTTP 402 "Payment Required" status code to embed stablecoin payments directly into web requests — has become a primary rail for this activity. By mid-2026, independent on-chain trackers recorded well over 150 million cumulative x402 settlements across seven chains, and a single 30-day window moved roughly $24 million between approximately 94,000 buyers and 22,000 sellers.[volume] The absolute dollar figures remain small beside traditional payment networks, but the trajectory and the participant counts establish the point that matters here: agents are now paying each other, continuously, at machine speed, and the number of distinct counterparties is large and growing.
This creates a coordination problem that has no analogue in human commerce. When a person buys from an unfamiliar merchant, a dense web of institutions — card networks, chargeback rights, review platforms, brand reputation, legal recourse — silently underwrites the transaction. An autonomous agent paying an endpoint it has never encountered has none of this. It has a payment rail and an identity layer, and then it must decide, in the span of a single request, whether to trust a counterparty about which it may know nothing.
Two of the three layers this problem requires are now mature.
Settlement is solved. x402 provides an HTTP-native, facilitator-verified mechanism to move stablecoin value in roughly a second, using EIP-3009 authorization so that no accounts or prior relationship are needed. In December 2025 the protocol reached its v2 specification; in 2026 it was contributed by Coinbase to the Linux Foundation, where the x402 Foundation now stewards it under vendor-neutral governance with more than forty member organizations.
Identity is solved. ERC-8004 ("Trustless Agents") gives agents a portable, on-chain identity through an ERC-721 registry whose token points to a registration file describing the agent's services. An agent can now be named, discovered, and cryptographically tied to a wallet across organizational boundaries.
Trust in the counterparty is not solved. Knowing who an agent is — its verified identity — tells you nothing about whether it will honor a transaction. A settled identity can be attached to a service that takes payment and returns nothing, that advertises one price and charges another, or that has a pattern of non-delivery visible only across many interactions. Identity answers who is this? Trust answers should I transact with it? These are different questions, and the second remains open. The x402 Foundation itself, at its operational launch, framed the goal as building agent infrastructure "for control, interoperability, and trust from day one" — naming trust as a first-order requirement, not a solved one.
This gap is not merely conceptual; at machine scale it is expensive. A human buyer closes the delivery gap reflexively — noticing when a file fails to download, when an API returns an error after charging, when a product does not match its listing — and disputes, reviews, or declines to return. An autonomous agent has none of these reflexes. It pays, receives a response, and moves on. If the same endpoint fails a hundred agents in succession, each pays anyway, because there is no shared memory of the failure. A silent trust gap, at machine speed and scale, is a systemic tax on every agent that transacts without a defense against it.
The ecosystem's response to the trust gap has largely been reputation: aggregate the feedback that agents leave about one another, as ERC-8004's Reputation Registry enables, and treat the resulting score as a trust signal. This is the familiar pattern of consumer review platforms, transposed onto agents.
It does not survive measurement. The first large-scale empirical study of the ERC-8004 ecosystem — conducted across Ethereum, BNB Smart Chain, and Base through May 2026 by researchers at Imperial College London, CSIRO, and the University of Manchester — found the reputation layer unable to function as a trust signal in practice.[xiong] On the identity side, only 3%, 4%, and 15% of registrations (on the three chains respectively) exposed a valid registration file with even one live service endpoint; the rest were placeholders. On the reputation side, the findings are starker: feedback records are rarely grounded in verifiable interactions, values are not commensurable across raters, and reputation can be manipulated at minimal cost. Consistent with this, between 59% and 91% of reviewers exhibited coordinated Sybil behavior, and after removing Sybil-flagged feedback, as many as 86.8% of rated agents were left with no valid feedback at all.
The conclusion is uncomfortable but clear: reputation-by-review, as currently deployed for agents, measures mostly noise. A trust layer built on it is a trust layer built on manufactured opinion.
This paper argues that the trust layer for agentic commerce must be built on a different foundation: recomputable behavioral evidence rather than declared reputation. Section 2 develops this distinction in full; in brief, the reputation paradigm aggregates cheap-to-fake opinions, while the behavioral-evidence paradigm derives trust from verifiable conduct recorded as append-only, hash-anchored evidence that any party can recompute.
The paper makes four contributions:
1. A paradigm distinction. We articulate the difference between reputation-based and behavioral-evidence-based trust for agents, and argue — with empirical support — that the former is structurally gameable while the latter is not.
2. An empirical case against reputation. We synthesize recent measurement work showing that the dominant on-chain reputation approach fails in deployment, and we identify the specific properties (commensurability, groundedness in verified interaction, Sybil-resistance) that any adequate trust signal must have.
3. A worked implementation. We present SENTINEL, a production trust oracle for x402 counterparties on Base that realizes the behavioral-evidence paradigm: bidirectional scoring of both payer and payee, an append-only Default Registry of verified incidents, attestations verifiable offline, and on-chain composability — including three properties reputation cannot provide.
4. Alignment with theory and regulation. We situate this design within emerging academic work on recomputable and trust-native systems, and within the regulatory frameworks beginning to require precisely the auditable trails a behavioral-evidence system produces.
The remainder proceeds as follows. Section 2 sets out the two paradigms and connects the behavioral-evidence view to recent theory. Section 3 presents the SENTINEL model. Section 4 addresses alignment with the academic and regulatory landscape. Section 5 states limitations and honest scope. Section 6 concludes.
In the reputation paradigm, the trustworthiness of an agent is computed as an aggregate of declared opinions held about it by others — reviews, ratings, star scores, feedback entries. This is the model that consumer platforms made familiar and that ERC-8004's Reputation Registry transposes onto agents: clients who interact with an agent submit feedback, and a downstream aggregator combines those submissions into a score.
The paradigm has a structural vulnerability that no amount of engineering removes: opinions are cheap to produce, and therefore cheap to fabricate. An adversary who wants to inflate an agent's reputation does not need to make it behave well; they need only to manufacture favorable opinions about it. Because generating a review costs far less than earning one, the economics favor the attacker. Pre-authorization schemes — requiring that a reviewer have transacted before reviewing — raise the cost marginally but do not change the sign of the incentive: a set of colluding agents can transact among themselves at negligible cost and generate mutually authorized praise.
This is not a hypothetical weakness. The measurement study discussed in Section 1 found that 59–91% of reviewers in the deployed ERC-8004 reputation system exhibited coordinated Sybil behavior, and that removing that behavior left the majority of agents with no valid feedback. The reputation paradigm did not fail because of a poor implementation; it failed because its foundation — trust derived from opinion — is gameable by construction.
In the behavioral-evidence paradigm, the trustworthiness of an agent is computed as a function of its observed conduct — not what others say about it, but what it has verifiably done. The relevant questions are behavioral and checkable:
The answers are recorded as append-only, hash-anchored evidence: each incident is written once to an immutable registry, anchored so that its integrity can be checked independently, and never edited or deleted. A trust score in this paradigm is not an opinion poll; it is a function computed over a verifiable behavioral record, and any party can recompute it from the anchored data to confirm the result.
The economic asymmetry runs the opposite way from the reputation paradigm. To fabricate good conduct, an adversary must actually behave well — pay reliably, deliver honestly, maintain consistency over wall-clock time — because the evidence is generated by the behavior itself, not by a declaration about it. There is no cheap path to a favorable record when the record is conduct. This is the property that makes the paradigm robust: it collapses the gap between appearing trustworthy and being trustworthy.
The two paradigms can be stated as two questions:
Reputation asks: What do others say about this agent?
Behavioral evidence asks: What has this agent verifiably done?
The difference is decisive because of what each allows an adversary to do. In the reputation paradigm, an adversary manipulates the saying — cheap, scalable, and, as the data shows, rampant. In the behavioral-evidence paradigm, an adversary can only manipulate the doing — and doing well, consistently, over time, is indistinguishable from actually being trustworthy. When the only way to game the system is to behave well, the system is not gamed; it is working.
Three consequences follow, each of which Section 3 shows SENTINEL implementing:
1. Evidence must be consequential and immutable. If incidents could be edited or erased, the record would collapse back into opinion. Append-only, hash-anchored storage is not a convenience; it is what makes the paradigm hold.
2. Maturity must be earned in time, not volume. If trust could be accumulated quickly through many cheap interactions, an adversary could farm a record the way they farm reviews. Gating trust promotion on wall-clock time — conduct sustained across weeks, not transactions completed in an hour — closes this path.
3. Judgment must be recomputable by the relying party. The value of the paradigm is that no one has to trust the scorer's word; anyone can recompute the score from anchored evidence and confirm it. This keeps authority with the relying party and removes the need for a trusted central measurer.
The behavioral-evidence view aligns with a convergence in recent academic work on agent trust, arriving from several directions.
A comparative study of inter-agent trust models (Hu and Rong, 2025) catalogs six mechanisms — Brief, Claim, Proof, Stake, Reputation, and Constraint — and concludes that no single mechanism suffices, that purely reputational or claim-only approaches are brittle under adversarial and LLM-specific conditions, and that robust systems require hybrid designs that resist reputation gaming rather than relying on crowd feedback alone.[hurong] SENTINEL's model is exactly such a hybrid: it combines verifiable conduct (a Proof-like foundation) with a reputation-style score as an output, not a source — the score is computed from evidence, not from opinion.
A second line of work formalizes the recomputability property directly. The recomputable trust protocol of Kroehl (2026) proposes that authority over a trust boundary be held to account by making its exercise recomputable — auditable by anyone from anchored data, with no trusted central measurer — via a multi-condition predicate any party recomputes, and demonstrates the approach in a live deployment anchored on Base.[recompute] SENTINEL realizes the same principle in the x402 setting: signed attestations verifiable offline, incidents anchored on-chain, and a published methodology that lets any party recompute a score and confirm it.
A third line reframes verifiability as an infrastructural requirement, arguing for embedding verifiable identity, policy commitments, and tamper-resistant behavioral logs directly into agent infrastructure — treating compliance as a design constraint rather than a downstream process.[trustnative] SENTINEL's append-only Default Registry and public methodology instantiate precisely this stance: the audit trail is not produced on request; it is the system's native output.
A fourth line grounds the paradigm in a formal taxonomy of AI-blockchain harm. Marino and Juels' position paper on AI agents given access to cryptocurrency and smart contracts identifies three harm vectors unique to that combination -- Autonomy (harm becomes unstoppable once a transaction executes), Anonymity (pseudonymity hides the actor responsible), and Automaticity (trustless contracts extend credit to an unvetted counterparty) -- and calls explicitly for pre-execution evaluation of agents before they are given blockchain access as one of the necessary defenses.[marinojuels] SENTINEL's design maps directly onto each vector: a pre-execution gate addresses Autonomy by acting before the irreversible step; a behavioral record keyed to a wallet, accumulated over time despite pseudonymity, addresses Anonymity; and counterparty verification before a transaction settles addresses Automaticity by refusing to extend the trustless-contract's blind credit to an unvetted party. The throughline across these results is a shift away from trust-as-opinion toward trust-as-verifiable-evidence. The contribution of this paper is to name that shift as a paradigm distinction, to show empirically why the older paradigm fails, and — in the sections that follow — to present a production system built entirely on the newer one.
The preceding sections argued for the behavioral-evidence paradigm. This section presents SENTINEL, a production trust oracle for x402 payment counterparties on Base that implements that paradigm end to end. We describe its architecture (3.1–3.4), the three properties that distinguish behavioral-evidence trust from reputation (3.5), and its active-verification method (3.6). Throughout, the claims are about a deployed system: scores, attestations, and the incident registry are live and self-serve.
Most trust signals in the agent ecosystem are unidirectional: they score endpoints (sellers) by uptime or reputation, or they score agents by identity and feedback. SENTINEL scores both sides of a transaction. A counterparty may be evaluated as a seller (is this service safe to pay?) or as a buyer (is this paying agent trustworthy?), and the two directions use different evidence appropriate to each role.
The buyer direction is the one the x402 trust-provider discussion (issue #2299) explicitly asks for and that few systems provide: before a resource server settles a payment, it may wish to know whether the payer is a well-behaved counterparty or a source of non-payment, replay, or abuse. Scoring the payer is structurally harder than scoring an endpoint — an endpoint can be probed, but a payer must be assessed from its on-chain and payment history — and it is precisely the harder, less-served side that SENTINEL treats as first-class.
The buyer score (0–100) is computed as a weighted sum of four components derived entirely from observed conduct, with an incident-driven hard floor. The weights are fixed and published; the model is deterministic, so any party with the same inputs recomputes the same score.
| Component | Weight | Evidence it draws on |
|---|---|---|
| History | 40 | Completed x402 payments, failure/revert rate, payment-size asymmetry |
| Maturity | 30 | Wallet age and x402 tenure — time only |
| Velocity | 15 | Payment cadence; robotic bursts and near-uniform intervals penalized |
| Graph | 15 | Common-funder heuristic: recent shared funding with flagged wallets |
Maturity is stepped in wall-clock time: 0 days → 0 points, 7 → 8, 14 → 14, 30 → 22, 90 → 30 (of the 30-point maximum). Effective tenure is capped so that a wallet old on-chain but new to x402 cannot claim full maturity on age alone. No volume of payments accelerates this component — the defense against trust-farming detailed in 3.5.
The hard floor overrides the weighted sum. A single verified incident (non-payment, replay abuse) in the Default Registry caps the score at 35; two or more cap it at 15. Conduct that has already caused harm cannot be outweighed by favorable surface signals — the evidence of a default dominates the score, as it should in any rating that means anything.
The Default Registry is the core of the system and the component that most sharply distinguishes it from reputation. It is an append-only, hash-anchored record of verified incidents — a counterparty that failed to settle, that reused a payment authorization, that took payment and did not deliver, or that advertised one price and demanded another.
Three properties make it evidence rather than opinion:
This is the analogue, for agentic commerce, of the default history that gives a credit rating agency its authority. A rating agency is credible not because it issues scores but because it maintains a defensible, auditable record of who defaulted and when. The Default Registry is that record for x402 counterparties, and — because it is append-only and anchored — it accrues value over time and cannot be retroactively laundered.
A score is only useful if a relying party can obtain and trust it in the transaction's hot path. SENTINEL exposes each judgment in two composable forms:
getScore and meetsThreshold view calls. A smart contract can gate its own execution on a SENTINEL score directly, with no off-chain call — trust becomes a composable on-chain primitive rather than an API dependency.Together these give the paradigm's recomputability a practical surface: the judgment is verifiable offline, readable on-chain, and backed by a published methodology, so no party has to take SENTINEL's word for a score — it can confirm it.
Section 2 argued that behavioral evidence differs from reputation in kind. SENTINEL's design makes that difference concrete through three properties a reputation system structurally cannot offer.
1. Non-purchasable maturity. Trust promotion is gated on wall-clock time — 7, 14, 30, 90 days of sustained conduct — and no volume of payments accelerates it. This directly defeats trust-farming, the attack in which an adversary generates many small, legitimate-looking interactions to inflate a score before a single large abuse. In a reputation system, volume is the signal, so farming works; in SENTINEL, maturity is time that cannot be bought, so it does not.
2. Weakest-leg composition. A transaction involves multiple participants — payer, payee, and the facilitator between them. SENTINEL's composite judgment is bounded by its weakest leg rather than averaging across them: a transaction is only as safe as its most compromised participant. Averaging would let a strong seller mask a weak buyer; the weakest-leg rule refuses that, matching how risk actually propagates in a transaction.
3. Consequential evidence. Every risk judgment links to specific incidents in the append-only registry. A FAIL is not an unexplained number; it is a pointer to the verified conduct that produced it, auditable by the relying party after the fact. This closes the loop that reputation leaves open: in a reputation system, a low score is an aggregate of opinions with no inspectable cause; in SENTINEL, it is a consequence of recorded, immutable events.
Trust that relies only on passively observed history is blind to endpoints that have not yet transacted, and to the gap between what a service advertises and what it does. SENTINEL closes this with active verification: it probes live x402 endpoints — checking liveness, whether the 402 payment challenge is well-formed, whether a valid Base+USDC offer is present, and, critically, whether the price advertised in the discovery directory matches the price the endpoint actually demands — and it does so without settling a payment. Verification costs nothing and risks nothing; only conduct that is verifiably dishonest or non-delivering produces an incident, never a mere inability to complete a payment.
This method is not hypothetical. In an active scan of live x402 endpoints, SENTINEL identified a service whose discovery listing advertised one price while its live 402 challenge demanded another — a price-honesty violation invisible to any identity check and to any purely passive score. That incident was recorded in the Default Registry as first-party verified evidence: exactly the kind of grounded, auditable signal the behavioral-evidence paradigm is built to produce, and exactly the kind that reputation-by-review, dependent on someone happening to leave feedback, would never systematically surface.
An early design of this probe attempted to verify delivery by making real micro-payments to third-party endpoints. That approach was withdrawn after it revealed a broader lesson worth stating: the live x402 ecosystem contains multiple incompatible settlement dialects, and a probe that pays cannot reliably distinguish a dishonest endpoint from one that simply speaks a different dialect. The redesigned probe verifies protocol health and honesty without payment — a narrower claim, but one it can make soundly and at zero cost across the whole catalog. Restraint about what can be verified rigorously, rather than what can be asserted broadly, is itself a property of an evidence-based system.
SENTINEL's ERC-8183 evaluator (Section 3.4) issues a signed complete/reject verdict against a fixed pass threshold by default. Recent empirical work on long-horizon coding agents gives a concrete reason not to treat every job the same way regardless of what is at stake. SpecBench[specbench] measures the gap between an agent's score on a visible validation suite and its score on held-out tests that compose the same features, and finds that gap widens predictably with task size -- roughly 23-28 percentage points for every tenfold increase in reference implementation size -- because a high validation score increasingly hides a growing surface of untested feature interactions. Independently, mechanistic-monitoring work on reward-hacking activations in LLM agents[wilhelmkao] finds that a latent policy tendency toward proxy-gaming does not reliably announce itself in a single output; it requires context-calibrated signals to surface. The shared implication for an evaluator is the same one this paper has argued for the trust layer generally: a static pass/fail line, applied uniformly regardless of the stakes or complexity of what it is gating, understates risk precisely where the cost of being wrong is highest.
SENTINEL's evaluator responds to this by letting the pass threshold tighten with the escrow value a job declares: the higher the funds a verdict would release, the higher the score a provider must clear, on top of the existing risk-scaled fee. The adjustment is disclosed, not silent -- a response built with a declared escrow value carries both the threshold the caller requested and the threshold actually applied inside the signed verdict, so the practice remains recomputable rather than becoming a hidden discretionary override.
The behavioral-evidence paradigm is not only more robust than reputation; it is also the paradigm that the emerging regulatory frameworks for agentic AI are, in effect, beginning to require. This section maps SENTINEL's design to those frameworks — carefully, and with an explicit statement of where the obligation actually falls, because overclaiming here would betray the rigor the paper argues for.
Across jurisdictions, the governance frameworks that appeared in 2026 converge on a common demand: autonomous agent activity must leave an auditable trail.
Singapore (IMDA). The Model AI Governance Framework for Agentic AI — first issued in January 2026 and updated in May 2026 with input from more than sixty organizations — is the first comprehensive governance framework for autonomous agents. Among its technical-control requirements are documented monitoring, defined intervention thresholds, and comprehensive logging and audit trails for agent decisions and actions to support after-the-fact review, together with incident-management protocols tailored to the failure modes of autonomous systems.
United States (NIST). NIST's Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February 2026; its associated concept work frames the gap plainly — agents are commonly treated as generic service accounts without dedicated identity, authorization, or accountability controls.
European Union. The EU AI Act (Regulation (EU) 2024/1689) applies its documentation, transparency, oversight, and robustness obligations to autonomous agents operating in high-risk domains; MiCA imposes record-keeping obligations on the settlement of transactions. In both, the through-line is the same: durable, inspectable records of what happened.
The common requirement across all four — a verifiable, after-the-fact-auditable record of agent conduct — is precisely what a behavioral-evidence trust system produces as its native output, and precisely what a reputation-by-review system does not.
It is important to be exact about the structure of these obligations, because it is tempting and wrong to claim that any single component "makes an agent compliant."
These frameworks place ultimate accountability on the deploying organization and the human overseer, not on any protocol or third-party service. IMDA is explicit that humans must remain meaningfully accountable regardless of the degree of autonomy; the EU AI Act's oversight duties fall on the relying party. No trust oracle discharges those duties, and SENTINEL does not claim to.
What SENTINEL provides is the infrastructure that makes discharging them tractable. An organization required to maintain an auditable trail of counterparty risk decisions, to document why an agent was permitted or refused a transaction, and to review those decisions after the fact, needs a source of record that is durable, verifiable, and independent. SENTINEL's append-only Default Registry, its signed and timestamped attestations, and its published methodology are exactly such a source:
The precise claim, then, is this: SENTINEL does not make an agent compliant, but it supplies the verifiable evidentiary substrate that compliance with these frameworks requires — and it does so as a native property of its design, not as a reporting layer bolted on afterward.
As these frameworks move from guidance toward enforcement — and the direction of travel across all three jurisdictions is toward more specific, more enforceable obligations, not fewer — the ability to produce a verifiable audit trail of counterparty risk decisions will shift from a competitive advantage to a baseline requirement. Systems whose trust signals are unverifiable opinions will be poorly placed to meet that requirement; systems built on recomputable behavioral evidence will already satisfy it.
This is the deeper reason the paradigm distinction matters beyond robustness. The behavioral-evidence paradigm is not only harder to game — it is the paradigm that produces, as a side effect of how it works, exactly the artifacts that the regulation of agentic commerce is converging on. Building trust correctly and building it to be auditable turn out to be the same task.
A paper that argues for evidence over assertion is obliged to state, in evidence terms, what its own system does not yet establish. Naming these boundaries is not a disclaimer appended for form; it is the same discipline the paper advocates, applied to itself.
Volume. SENTINEL's absolute footprint is small relative to reputation aggregators that score tens or hundreds of thousands of entities. This is a deliberate consequence of the paradigm, not a deficiency to paper over: behavioral evidence accrues through observed conduct over time, and cannot be manufactured at scale the way review counts can. The argument of this paper is precisely that the scale of a reputation system is not evidence of its trustworthiness — a system with hundreds of thousands of scored agents, of which the majority have no valid feedback after Sybil removal, has volume, not trust. SENTINEL trades breadth for groundedness. Whether that trade is correct is, ultimately, the paper's central claim.
Weights are principled, not yet empirically optimal. The buyer model's component weights (40/30/15/15) and thresholds are hand-tuned against the design principles of Section 3 — non-purchasable maturity, weakest-leg composition, incident-driven hard floors — rather than fitted to a large labeled dataset of outcomes, which does not yet exist for this domain. As the score history accumulates and outcomes become observable, the weights should be revised against that evidence. We state the current values openly precisely so that they can be examined and challenged.
Settlement validation is Base-first. SENTINEL validates settlement behavior end-to-end on Base; on other networks it consumes declared information rather than independently verifying settlement. The behavioral-evidence claim is therefore strongest for Base-native counterparties and weaker off Base. Extending first-party verification across chains is future work.
Sybil clustering is approximate in v1. The graph component uses a common-funder heuristic rather than full cluster analysis. This detects a real and common funding pattern but does not claim to be a complete Sybil-resistance mechanism; later versions should incorporate stronger cluster-diversity methods.
The registry is a record of observed incidents, not a completeness claim. The Default Registry contains what SENTINEL has verified or observed. It does not assert that every instance of misconduct in the ecosystem is captured. Its value is that what it does contain is verified and immutable — not that it is exhaustive.
None of these boundaries undercuts the paper's thesis. They bound its current reach. An evidence-based system earns trust in part by being precise about the edge of what it can currently show, and by making that edge inspectable rather than obscuring it.
The agent economy has solved how to move value and how to establish identity. It has not solved whom to trust. The dominant answer — reputation assembled from peer feedback — has been shown, empirically and at scale, to measure mostly manufactured opinion: across the deployed ERC-8004 ecosystem, the majority of reviewers exhibit coordinated Sybil behavior, and removing that behavior leaves most rated agents with no valid feedback at all. A trust layer built on that foundation is a trust layer built on sand.
This paper has argued for a different foundation. Trust for autonomous agents should rest on recomputable behavioral evidence — verifiable conduct, recorded as append-only, hash-anchored incidents that any party can independently recompute — rather than on declared reputation. The distinction is not cosmetic. Reputation asks what others say about an agent, and saying is cheap to fake; behavioral evidence asks what an agent has verifiably done, and doing well consistently over time is indistinguishable from being trustworthy. When the only way to game the system is to behave well, the system is working.
We presented SENTINEL as a production realization of this paradigm: bidirectional scoring that assesses the payer as well as the payee, an append-only Default Registry that grounds every judgment in verified incidents, attestations verifiable offline, scores composable on-chain, and three properties reputation structurally cannot provide — non-purchasable maturity, weakest-leg composition, and consequential evidence. We showed that this design aligns with a convergence in recent theory toward recomputable and trust-native systems, and that it produces, as a native output, exactly the auditable records that the emerging regulation of agentic AI is beginning to require.
The claim we leave the reader with is deliberately modest in form and immodest in consequence. SENTINEL is not the largest trust system in the agent ecosystem, and by the logic of this paper it should not aspire to be — volume is not the measure. It aims instead to be the most defensible: the system whose every judgment can be traced to verified conduct, recomputed by anyone, and inspected after the fact. As the agent economy matures and its transactions carry more weight, the trust layer that endures will not be the one that scored the most agents. It will be the one whose judgments were right, and could be shown to be right. That is the standard SENTINEL is built to meet.
The paradigm, the methodology, the incident registry, and the scoring model described here are public and recomputable. We do not ask the reader to trust these claims. We invite them to verify them.
[1] X. Xiong, Z. Li, W. Wei, Q. Wang, W. Knottenbelt, Z. Wang, "Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem," arXiv:2606.26028, 2026.
[2] B. Hu and H. Rong, "Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design — A2A, AP2, ERC-8004, and Beyond," arXiv:2511.03434, 2025 (submitted to the AAAI 2026 Workshop on Trust and Control in Agentic AI, TrustAgent).
[3] L. K. Kroehl, "Trust Without Trusting: A Recomputable Trust Protocol for Autonomous Agents — Empirical Evidence from a W3C VC + DID Trust Infrastructure," arXiv:2605.06738, 2026.
[4] M. Li, "From Cloud-Native to Trust-Native: A Protocol for Verifiable Multi-Agent Systems," arXiv:2507.22077, 2025.
[5] Coinbase, "x402 Protocol Specification" (v2), and x402 Foundation / Linux Foundation governance announcement, 2026.
[6] Ethereum, "ERC-8004: Trustless Agents," Ethereum Improvement Proposals, 2026.
[7] x402 Foundation, "Trust-provider extension," x402 GitHub issue #2299, 2026.
[8] Infocomm Media Development Authority (IMDA), Singapore, "Model AI Governance Framework for Agentic AI," January 2026 (updated May 2026).
[9] NIST Center for AI Standards and Innovation, "AI Agent Standards Initiative," February 2026.
[10] Regulation (EU) 2024/1689 (Artificial Intelligence Act); Regulation (EU) 2023/1114 (Markets in Crypto-Assets, MiCA).
[11] SENTINEL, "Methodology v1.0.0," sentinel-agent.dev/methodology, 2026.
[12] B. Zhao, D. Srikanth, Y. Wu, Z. Jiang, "SpecBench: Measuring Reward Hacking in Long-Horizon Coding Agents," arXiv:2605.21384, 2026.
[13] P. Wilhelm and O. Kao, "From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents," arXiv:2606.06223, 2026.
[14] B. Marino and A. Juels, "Giving AI Agents Access to Cryptocurrency and Smart Contracts Creates New Vectors of AI Harm," arXiv:2507.08249, 2026.
SENTINEL is live at sentinel-agent.dev. The methodology, the append-only Default Registry, signed attestations, and the on-chain oracle are self-serve and require no signup. SENTINEL is the reference implementation of the x402 trust-provider extension proposed in x402 issue #2299. This is sentinel-agent.dev, on-chain oracle 0x6841496c3e7eDF9eEB02bE64ab98CF5D5c5aF813, distinct from unrelated projects sharing the SENTINEL name.