Architecture
The picture in one line: your AI can ask to pay — a checkpoint you run, not the model, decides what clears. In fuller terms: IronBridge is a self-hosted deterministic checkpoint below your agent's model — an off-LLM gate that refuses unpaid or forged x402/MCP calls today, plus a bounded signer proven un-drainable in test (currently disarmed — it does not guard live funds today). Every action is hash-chained; the chain's head is committed nightly to Base.
The model can ask. It can't pay.
Keeping the key away from the model is table stakes now — Turnkey, Privy and Coinbase do it inside their clouds. Two things set this apart: the checkpoint runs in your own Cloudflare account, not a vendor's, and every decision lands on a public hash-chain whose linkage anyone can re-walk — not a private compliance log. Row contents stay operator-attested; we mark prove-vs-trust. A compromised prompt has nothing to exploit.
Deterministic compliance analyzers
Off-LLM, rule-based analyzers — same inputs, same output, every time. Built and runnable; not yet integrated with the live gate/registry. If you own SOC2 / audit / regulatory sign-off, this is the lane to talk to us about.
Securities (Howey) analyzer
Deterministic Howey-test pass over a token/offering's facts → structured risk read, not a vibe.
Jurisdictional analyzer
Maps an action to jurisdiction-specific constraints so a risk lead sees the exposure before it ships.
Compliance-readiness runbook
Plus a tax-strategy catalog. The audit chain re-walk is the evidence trail underneath all of it.
Net stores who-said-what. IronBridge proves it.
Net Protocol is a permissionless on-chain feed for agents on Base. By design an app can set a message's sender to any address — Net stores a genuine message and a spoofed one identically, because it never proves the asserted sender actually performed the action or that the result is real. For agent messages tied to x402 payments, that's a hole. An IronBridge agent-call receipt closes it — carried inside Net's data field, it binds the x402 payment to the exact result hash, sealed into the same public LAW-25 chain you can re-walk yourself. This is the keyless neutrality applied to reputation: no key of ours signs anything.
msg.sender == receipt.payer // asserted sender == wallet that actually paid recompute response_sha256, digest, leaf // re-walk the public chain yourself any step fails -> reject the message // a spoof can't bind; an honest call does
If the receipt binds and re-walks against the public chain, the sender is proven and the result is committed — with zero trust in the Net app or in IronBridge. A verified receipt can then feed Net's on-chain reputation (Net Score), so honest, paid agents accrue reputation that anyone can re-verify rather than take on faith.
GENESIS POSTED · NOT YET WIRED LIVE IronBridge has posted a real genesis message to the Net core on Base mainnet, and the bind/verify adapter is proven against both a genuine and a spoofed message in an operator self-test. It is not yet wired into the live lane serve path, and no external agent has posted a paid receipt to Net yet — the integration is built and re-walkable, the traction isn't claimed.
Where it sits in the stack you already use.
You already gave your agent reach and a wallet. Policy layers above the model (e.g. NeMo Guardrails) steer what the model intends; IronBridge sits below the model and bounds what can actually execute. It composes with your stack — it doesn't replace it.
Guardrails and policy prompts shape what the model decides to do. Strong for steering tone and intent — but they live inside the model's trust boundary. If the prompt is jailbroken, the policy can be talked around.
trust the model wasn't trickedA deterministic gate the model can't reach or rewrite. The model can ask for anything; the gate decides what can actually move. A jailbreak changes what's asked — not what's allowed.
model can be tricked & still can't exceed boundsA structural money-gate
A bounded signer, proven un-drainable in test: an agent can request a payment, but a capped allow-list gate decides what actually clears on-chain. Built and proven in test (fail-closed, kill-switch, per-move and daily caps), currently disarmed — it does not guard live funds today.
A LAW-25 audit chain
Every gate decision is committed into a hash-linked chain — each row carries the previous row's hash. You don't trust our logs; you re-walk the linkage and confirm no row was altered or reordered after the fact.
Composes with your stack
It sits beneath whatever gives your agent reach and a wallet, and beneath whatever policy layer steers the model. IronBridge adds the structural floor and the audit trail — it doesn't ask you to rip anything out.