1
00:00:00,000 --> 00:00:04,333
A private credit fund can only sell to accredited investors.

2
00:00:04,333 --> 00:00:10,233
So today, every buyer uploads a passport, bank statements, and a net worth letter.

3
00:00:10,233 --> 00:00:12,400
And the fund stores all of it.

4
00:00:12,967 --> 00:00:18,500
That is a compliance cost on the way in, and a breach liability forever after.

5
00:00:18,500 --> 00:00:22,400
They become custodians of a data set they never wanted,

6
00:00:22,367 --> 00:00:25,067
just to answer one yes or no question.

7
00:00:25,633 --> 00:00:30,733
Now the investor delegates buying to an AI agent, and two things break at once.

8
00:00:30,733 --> 00:00:33,433
The agent needs their account credentials.

9
00:00:33,433 --> 00:00:36,467
And the limits live in the agent's own prompt —

10
00:00:36,467 --> 00:00:40,733
which is exactly the thing that cannot be trusted to enforce them.

11
00:00:41,267 --> 00:00:43,067
Gatekeeper answers both.

12
00:00:43,067 --> 00:00:47,633
The fund learns exactly one fact — this buyer is accredited —

13
00:00:47,600 --> 00:00:52,367
proven by a zero knowledge proof, never the net worth behind it.

14
00:00:52,367 --> 00:00:58,633
And the mandate lives inside the enclave, so the agent cannot widen its own ceiling.

15
00:00:59,200 --> 00:01:02,667
Here is a real run against the live network.

16
00:01:02,667 --> 00:01:04,567
The credential verifies.

17
00:01:04,533 --> 00:01:07,667
A $1,000 purchase is inside the mandate,

18
00:01:07,667 --> 00:01:12,533
so the enclave approves it and makes the outbound call itself.

19
00:01:12,567 --> 00:01:15,300
HTTP 200, from inside the hardware.

20
00:01:15,867 --> 00:01:18,433
Nine thousand dollars is over the cap.

21
00:01:18,433 --> 00:01:20,733
Same entry point, same code path —

22
00:01:20,733 --> 00:01:25,467
but the decision and the network call are the same enclave invocation,

23
00:01:25,433 --> 00:01:29,067
so a rejected action never reaches the network at all.

24
00:01:29,667 --> 00:01:35,267
Then I audited my own contract, and found three ways the gate could be bypassed.

25
00:01:35,267 --> 00:01:38,433
It accepted a mandate supplied by the caller.

26
00:01:38,433 --> 00:01:43,700
Decide and dispatch were separate calls, so the agent could skip the first.

27
00:01:43,700 --> 00:01:49,167
And the velocity window was caller supplied, so renaming it reset the counter.

28
00:01:49,733 --> 00:01:50,667
And a fourth.

29
00:01:50,667 --> 00:01:53,500
The gate trusted any credential issuer.

30
00:01:53,500 --> 00:01:56,900
A signature proves the issuer signed the claim.

31
00:01:56,900 --> 00:02:01,900
It says nothing about whether that issuer is anyone the fund trusts —

32
00:02:01,900 --> 00:02:05,000
and the agent generates its own issuer key.

33
00:02:05,033 --> 00:02:09,100
So it could mint its own accredited investor credential.

34
00:02:09,633 --> 00:02:12,900
82 automated tests, mostly wrong paths.

35
00:02:12,900 --> 00:02:17,000
A gate that only proves it says yes is worthless.

36
00:02:17,000 --> 00:02:21,867
19 bugs and documentation gaps reported, with repro steps.

37
00:02:21,867 --> 00:02:23,633
Everything is public.

38
00:02:24,200 --> 00:02:31,333
Code, screenshots, and every command run for real are at gatekeeper-evidence.vercel.app