Nairobi_

The sanctions check came back green.
That was when the room relaxed.
Bad moment.
Intent had already landed inside Newton. Gateway took it cleanly. JSON-RPC request looked boring. Fields shaped right. Wallet, counterparty, amount, destination, policy context. Nothing dramatic. Operator routing picked it up and sent the thing into the part everyone pretends they respect until the first clean answer arrives.
Then the PolicyData oracle answered.
Green.
Not flagged.
Not blocked.
Nice little word. Green.
Desk heard permission.
Newton had only received data.
That gap matters.
The Rego policy still had to touch the full transaction context. The operator network still had to evaluate the policy path. The PolicyData oracle answer had to sit inside a moment, not float above the route like permanent truth.
But the screen had already done damage.
Green makes people soft.
I have seen that shortcut too many times. The oracle returns a clean external signal and everybody upgrades it into a decision. Sanctions answer clean. Wallet risk clean. Price feed clean. Gas condition clean. Yield condition clean. Whatever the runtime fact is, the desk starts acting like Newton already cleared the transaction.
No.
That was just one piece arriving.
The ugly part came three minutes later.
Counterparty state changed.
Not huge. Not cinematic. Just enough.
A new provider update hit. Same wallet now carried a different risk score. The old PolicyData answer was still real. Nobody was saying it was fake. Nobody was saying the oracle lied. That would have been easier. Bad oracle, bad data, bad outcome. Clean postmortem. Easy blame.
This was worse.
The oracle answer was valid when it was returned.
The decision moment had moved.
And Newton does not let that become a comfortable sentence.
Because policy is not just “what did the oracle say?” Policy is “what did the oracle say when this transaction was being judged, inside this route, against this context, before execution?”
That is much harder to keep in your head when a green answer is already sitting in the file.
The operator result came back slower than the desk wanted.
Someone asked whether the oracle answer had expired.
Someone else said it was still inside the policy window.
Then the argument started doing that familiar Newton thing where everyone uses the same words and means different systems.
Current.
Valid.
Fresh.
Accepted.
Authorized.
All dangerous words when timing is doing the real work.
The PolicyData oracle did not become wrong just because the market moved or the risk feed changed. But the desk had treated the oracle answer like it could survive outside the route. Like green was a property of the transaction forever. Like the external world had agreed to freeze itself because Newton got one clean response.
It did not.
That is the part people hate.
Newton can pull in external signals, but those signals do not become magic law just because they arrived through the proper path. The Rego policy can use the answer. Operators can sign the result. ECDSA data attestations can prove what data was supplied. Fine. Useful. Necessary.
Still not timeless.
A PolicyData answer belongs to its evaluation moment.
Move the moment and the answer starts getting weird.
That was where the desk got trapped.
If they rejected the transaction, someone would ask why a green oracle answer got ignored.
If they accepted it, someone would ask why a later risk state was not considered.
Both questions sounded fair.
Both were slightly dishonest.
Because the real question was not whether the oracle was green or red.
The real question was which slice of time Newton was allowed to treat as the decision surface.
That is where $NEWT starts feeling less like some clean protocol token story and more like pressure around accountability. Somebody pays for policy checks. Somebody relies on operator evaluation. Somebody wants to know why capital moved against a state that looked stale five minutes later.
And “the oracle was green” is not enough.
Too soft.
Which PolicyData oracle?
Which provider timestamp?
Which Rego policy branch consumed it?
Which operator saw which transaction context?
Which ECDSA data attestation proves the answer used at evaluation?
Which state existed before execution?
That is the audit path people suddenly want after they already trusted the easy color.
Green.
I keep coming back to that word.
It is too emotionally final for something that may only be momentarily useful.
Newton’s uncomfortable lesson here is not that oracles are dangerous because they can lie. Everyone knows that version. The sharper version is that oracles can tell the truth and still leave the desk with a bad operational read.
Truth at one moment.
Decision at another.
Settlement after both.
That little sequence is where clean dashboards start lying without technically lying.
The PolicyData oracle answered.
The Rego policy evaluated.
The operator network signed.
The transaction moved.
Then someone looked backward and tried to make the whole thing feel like one static decision.
It was not.
It was a route through time.
And the moment the desk forgot that, the green answer became too powerful.
Not because Newton overtrusted it.
Because humans did.
The oracle gave a fact.
The desk borrowed certainty.
That upgrade happened off-protocol.
And later, when the risk state changed and the file still had that green answer sitting near the top, everybody wanted Newton to explain why the past had looked so safe.
The answer was ugly.
The past did not look safe.
It looked valid for the moment Newton used it.
Different thing.
Much harder to defend in a meeting.
@NewtonProtocol #Newt $LAB $TAC

The AI agent did not worry me when it gave a suggestion.
It worried me when the suggestion became a transaction.
That is the line I keep coming back to while looking at Newton Mainnet Beta.
Most AI narratives still talk like the main problem is intelligence. Better model. Better prediction. Better agent. Cleaner automation. But on-chain, intelligence is not the final risk. The final risk is authority.
Who allowed the agent to act?
What exactly was it allowed to do?
Which limit did it have to respect before touching funds?
And that the action had passed the right rule?
Tha when the transaction reached the contract, what proof existedt is where @NewtonProtocol becomes interesting to me.
Newton is not trying to make an AI agent sound smarter. It is trying to make agent actions harder to trust blindly. That difference matters.
A normal agent flow can look safe until it has wallet access. Then the whole trust problem changes. A hallucinating agent is no longer just producing a bad answer. It might interact with the wrong contract. It might spend more than intended. It might move outside the scope the user thought was granted. It might follow a manipulated prompt into a transaction that looks technically valid but operationally wrong.
This is why I like the way Newton frames the problem through policies and intents.
The agent wants to do something.
That proposed action becomes an intent.
The intent is checked against a policy.
Operators evaluate the task.
A cryptographic attestation comes back.
The PolicyClient verifies that proof before execution.
That is a very different mental model from “my agent has permission.”
Permission becomes conditional.
Execution becomes reviewable.
Automation has to pass through a rule before it becomes movement.
The part I think many users will misunderstand is the final screen.
If an AI agent submits a transaction and it passes, people may describe it as autonomous execution. That sounds smooth. Maybe too smooth. Because the valuable part is not that the agent acted. The valuable part is that the action was forced through a policy path first.
Autonomy without a boundary is just delegated risk.
Newton’s stronger idea is bounded autonomy.
An agent can operate, but not outside the rules attached to the user, the wallet, the contract, or the application. A spending cap can matter. A contract allowlist can matter. A function restriction can matter. Rate limits can matter. Human approval thresholds can matter. These are not exciting marketing words, but they are the controls that make agentic finance less reckless.
That is also why Newton Mainnet Beta is worth watching beyond the usual launch excitement.
Mainnet Beta is not only a milestone. It is the first serious test of whether verifiable authorization can feel usable when real builders, real policies, and real transaction paths are involved. The architecture can look clean in documentation, but production pressure is different.
Operators have to evaluate.
Quorum has to form.
BLS attestations have to be verified.
Incorrect evaluations need to remain challengeable.
Slashing has to be more than a theoretical security promise.
That middle layer is the whole point.
Without it, the user is back to trusting the agent, the app, or a centralized policy server. With it, the user can ask a harder question:
Did this transaction merely happen, or did it prove it was allowed before it happened?
That question feels small until AI agents start managing larger on-chain workflows.
Treasuries.
Vaults.
Payments.
DeFi strategies.
Recurring actions.
Cross-app execution.
The more agents do, the less comfortable I become with broad permissions. I do not want an agent that can “generally help.” I want an agent whose authority is narrow, visible, and enforced at execution time.
That is the side of Newton I think deserves more attention.
Not the idea that AI agents will automate everything.
The idea that automation needs a proof boundary before it becomes safe enough to scale.
For me, $NEWT becomes interesting if Newton can keep that boundary visible as usage grows. The market will talk about AI agents. It always does. But the deeper test is whether those agents can act without turning user permission into an open-ended blank check.
The agent may be autonomous.
The authorization should not be vague.
That is the difference I am watching in Newton Mainnet Beta.
#Newt @NewtonProtocol $LAB $TAC

The Slack message looked like good news.
Agent run completed.
Spend remained below max_agent_spend.
No human approval required.
A few people relaxed right there.
Then someone opened the trace and asked why the agent had called approve.
Not swap.
Not repay.
Not the cleanup function it was supposed to use.
Approve.
Same contract family. Same general workflow lane. Still inside the NewtonPolicyClient envelope. Still under the spending cap. Still technically inside the budget.
And suddenly the comforting sentence, “it stayed under the limit”, started sounding stupid.
That is the trap Newton exposes better than most systems. People hear AI agent wallet and immediately reach for the easiest safety story: just cap the spend. Put a ceiling on the damage. Add max_agent_spend. If the agent cannot drain the wallet, then the risk must be contained.
Except agents do not only create risk by spending too much.
They create risk by doing the wrong thing while looking financially disciplined.
That run made the problem embarrassingly clear. The contract was on the contract allowlist. So nobody flinched when the intent came through. The amount did not cross the human approval threshold. So no escalation got triggered. The pace of activity stayed inside the rate limiting rules. Destination restrictions were not obviously violated. Every shallow comfort light stayed green.
But the function was wrong.
And onchain, wrong function is not a cosmetic issue. Wrong function can mean a permission granted instead of a payment made. An allowance opened instead of a trade executed. A state change that fits the budget and still leaves the user exposed in a completely different direction.
That is why Newton’s agent security model matters before execution, not after the wallet balance updates. Pre-execution policy evaluation is not there just to ask how much the agent is about to spend. It is there to ask what the agent is actually trying to do. NewtonPolicyClient can enforce a function allowlist, not just a contract allowlist. It can bind the agent to destination restrictions, time windows, spending caps, and approval thresholds before the call ever lands.
Because “allowed contract” is too broad.
Way too broad.
A protocol can be safe for one function and dangerous for another. A treasury tool can be approved for rebalance calls and still be the wrong place to hand out permissions. An agent can stay under max_agent_spend all week and still behave in ways nobody would describe as safe if they had to read the raw function names out loud.
That is the human mistake here. Teams keep collapsing agent safety into balance protection. They look at the wallet first because it is measurable. Did funds leave? How much? Did the cap hold?
Useful questions.
Incomplete ones.
Newton makes that incompleteness painful because it forces policy down to the action level. Not “is this contract generally okay.” Not “did the agent stay under budget.” More specific. More annoying. Is this exact call, to this exact destination, under this exact context, something the agent should be allowed to do without a human stepping in?
That is a different standard.
A stronger one too.
And it has to be, because prompt injection defense for agents is not only about preventing catastrophic drains. Sometimes the agent remains polite, cheap, and totally within budget while still taking the wrong branch through an allowed system. That is the kind of mistake that makes dashboards look calm right until someone notices the permissions footprint afterward.
So yes, the agent stayed under the limit.
Great.
But if it called the wrong function on an allowed contract and no policy stopped it before execution, then what exactly got protected?
The user?
Or just the balance line everyone likes looking at first?
@NewtonProtocol #Newt $NEWT
$TAC
$EVAA

その取引は数が小さかったので無害に見えました。
それが最初の罠でした。
ウォレットからの流出はありません。
巨額の送金はありません。
派手なエージェントのループで公に資金を燃やし尽くすようなことはありません。
「max_agent_spend」の上限の下で、ただ小さなAIエージェントの動作が落ち着いて行われただけです。
みんなが早すぎると安心してしまうような種類の取引。
私は以前、ニュートン・プロトコルで最も重要なエージェントの問いは単純だと思っていました。
このエージェントはいくらまで使えるの？
その問いは重要です。
しかし、それが傷のすべてではありません。
なぜなら、AIエージェントのウォレットは予算を守ることもできるのに、仕事を裏切れるからです。

ニュー トンのプロトコルにある危険な一行は、こう思えていました：
allow = true
きれいに。
最終的に見える。
スクリーンショットしやすいです。
しかし、前回の（より早い）ミスは、Rego が答えを返す前に起きます。
それは、システムがこの取引にとって「世界」が何を意味するかを決めるときに起きます。
取引の意図が入ってきます。まだ決済済みの状態ではありません。現実になろうとするアクションが入るだけです。
金額。
受取人。
関数呼び出し。
チェーン。
ポリシーID。
たぶん制裁（サンクション）のチェック。
たぶんリスクスコア。
もしかすると、命令（マンダート）のもとで資金を動かすAIエージェント。
最初は簡単そうに聞こえます。

ニュー トンのプライバシー・アーキテクチャを開き、最も強い部分は暗号化だと期待した。
違った。
私に残ったのは、暗号化が“物語の全て”ではなくなった瞬間だった。
レイヤー1。
しきい値復号。
標準モード。
クライアントは機密のポリシーデータを、しきい値の公開鍵のもとで暗号化する。単一の運用者が完全な秘密鍵を保持することはない。データは暗号文として移動する。運用者たちは部分復号の共有（デクリプション・シェア）を公開する。十分な共有が揃って初めて、平文を復元できる。
クリーン。
分散型。

私を悩ませたのは、署名ではありませんでした。
それがどれほど落ち着いて見えたか。
1つのBLS集約署名。
1つのコンパクトな証明。
スマートコントラクト側での1つの検証チェック。
人はそういう種類のものを、あまりにも早く信じてしまいます。
部屋いっぱいのオペレーターの判断があるようには見えないからです。
それはステーク量のようには見えません。
フィルタにかけて除外しなければならなかった不一致には見えません。
クオーラムが達成されたようには見えません。
ただ1つの署名にしか見えません。
通過するのに十分きれいです。
無視できるくらい小さい。

以前は、難しいのはデータをトランザクション経路に入れることだと思っていました。
価格フィード。リスクスコア。アカウント状態。外部シグナル。
次に何が起きるかを判断する前に、システムが必要とするオフチェーンの事実がいくつかあります。
それは読み取りとしては簡単でした。
Newton（@NewtonProtocol ）が、居心地の悪い部分をもう一段下に押し下げます。
入力されたデータだけではありません。
それを支えたのは誰ですか？
そこで、ECDSAのデータ証明が見た目以上に重要になります。
データポイント単体は柔らかいものです。
数値はコピーできます。応答は中継できます。バックエンドは「これはプロバイダーから来た」と言えます。ダッシュボードは値を表示できます。オペレーターはそれを使って意図を評価できます。

ニュートン・プロトコルのフローを開き、決済レイヤーが最も強い部分のように感じられることを期待した。
そうではなかった。
それが驚きだった。
決済が弱いからではない。
決済は、ブロックチェーンがすでに真剣であることを知っているまさにその場所だ。
最終状態。
確認済みトランザクション。
不変の記録。
契約の結果。
何かが実行されたかどうかに曖昧さはない。
その部分はすでに大きな音がしている。
より静かな部分はその前にあった。
境界。
アプリケーションが意図から実行へ移りたい場所だが、ニュートンはその取引をまず認可を通して行わせる。