A private credit fund can only sell to accredited investors.
So today, every buyer uploads a passport, bank statements, and a net worth letter.
And the fund stores all of it.
That is a compliance cost on the way in, and a breach liability forever after.
They become custodians of a data set they never wanted,
just to answer one yes or no question.
Now the investor delegates buying to an AI agent, and two things break at once.
The agent needs their account credentials.
And the limits live in the agent's own prompt —
which is exactly the thing that cannot be trusted to enforce them.
Gatekeeper answers both.
The fund learns exactly one fact — this buyer is accredited —
proven by a zero knowledge proof, never the net worth behind it.
And the mandate lives inside the enclave, so the agent cannot widen its own ceiling.
Here is a real run against the live network.
The credential verifies.
A $1,000 purchase is inside the mandate,
so the enclave approves it and makes the outbound call itself.
HTTP 200, from inside the hardware.
Nine thousand dollars is over the cap.
Same entry point, same code path —
but the decision and the network call are the same enclave invocation,
so a rejected action never reaches the network at all.
Then I audited my own contract, and found three ways the gate could be bypassed.
It accepted a mandate supplied by the caller.
Decide and dispatch were separate calls, so the agent could skip the first.
And the velocity window was caller supplied, so renaming it reset the counter.
And a fourth.
The gate trusted any credential issuer.
A signature proves the issuer signed the claim.
It says nothing about whether that issuer is anyone the fund trusts —
and the agent generates its own issuer key.
So it could mint its own accredited investor credential.
82 automated tests, mostly wrong paths.
A gate that only proves it says yes is worthless.
19 bugs and documentation gaps reported, with repro steps.
Everything is public.
Code, screenshots, and every command run for real are at gatekeeper-evidence.vercel.app