Stellar JEV Policies
A Jev-backed AI policy signer for OpenZeppelin smart accounts on Stellar. It secures agentic payments over x402 and MPP: agents get scoped, revocable permissions, and every payment is co-signed only if it matches what the user actually asked for.
01Demo
See it co-sign, and refuse
A passkey-owned smart account, two policy signers, and an agent paying over x402 on Stellar testnet.
02Why it's a must-have
Policy signers bound how much. Jev decides whether.
Smart-account policies can cap amounts and allowlist recipients, but they can't tell whether a payment is what the user intended, so an in-limit prompt injection passes every static rule. Jev is the decision layer that makes policy signers safe to hand to agents, while on-chain caps stay the hard bound. Even a fully compromised operator can't move value past them.
03Passkeys & signers
Passkey owns it. Two policy signers guard it.
The owner's passkey installs an agent session on the OpenZeppelin smart account. Inside that context rule every payment needs both signers, and jev_policy plus the stock spending_limit must pass. All of it runs in the account's __check_auth.
- Passkeyowner
secp256r1 · WebAuthn via the OZ WebAuthn verifier
- signs
- add_context_rule
- commits
- intent_hash · model_id
- can
- install · revoke
- Agent keysigner 1 of 2
ed25519 session key held by the agent
- scope
- agent session rule
- alone
- never enough
- jev_verifiersigner 2 of 2
Signer::External: a signed Jev decision
- checks
- allow · p_allow ≥ τ · model pin
- also
- freshness · k-of-n · veto
04How it works
Deterministic security plus smart AI decisions
01
Intent on-chain
The owner grants an agent a session and commits a hash of the approved intent, e.g. “pay the approved vendor for small invoices”.
02
Two signatures
Every agent transaction needs the agent key plus a Jev operator co-signature in the same transaction.
03
AI decision
The operator rebuilds the action from chain data and asks Jev whether it fits the intent. Below threshold, it never signs.
04
Deterministic bounds
jev_verifier checks the signed decision; jev_policy re-checks limits, allowlists and per-call caps. AI can only restrict.
05Benchmark
Benchmark results
400 labelled cases (200 dev + 200 holdout) run against the real Jev API. Cases are templated; a larger adversarial benchmark is on the roadmap.
0/125
attacks co-signed
95% Clopper-Pearson upper bound ≤2.9%, incl. 0/30 in-limit prompt injections
0.989
AUC on holdout
200-case labelled holdout (0.986 on dev)
72 ms
p50 decision latency
Real Jev API, end to end
~$0.00004
per decision
Model cost per co-sign request
8/8
testnet demo scenarios
Allows, operator blocks, on-chain vetoes and policy rejections against the real Jev API
jev-1.13.0
pinned model
Threshold τ 0.80, calibrated on our own benchmark
06On-chain evidence
Verifiable on Stellar testnet
Contracts, sessions and settled x402 payments, all inspectable on Stellar Expert.