PaperlayerView exact revision on arXiv

Source-linked AI summary

Bonded Recourse for Smart-Contract Settlement of Compensable Agent Side Effects

Laurent Bindschaedler, Quentin Botha, Christoph Siebenbrunner

arXiv:2609.01939v1cs.CRcs.DCcs.MA

TL;DR

Autonomous agents can leave residual harm after permitted actions fail, beyond what authorization and local rollback settle. Recourse binds actions to scope, recovery, evidence, payout, and collateral, then uses typed receipts and optimistic or arbitral settlement; bonded coverage cuts uncompensated harm against authorization-and-local-recovery baselines.

  • Problem

    Authorization and local compensation do not settle residual harm left when a permitted autonomous action fails across separate control planes.

  • Method

    Recourse pre-validates scope, recovery, evidence, measurable loss, payout rules, and bond coverage, then settles signed receipts through optimistic challenge or arbitration.

  • Results

    49.8 % ± 12.6 pp reduction in uncompensated harm versus an authorization-and-local-recovery baseline on a deterministic Postgres harness.

  • Takeaways & Limitations

    The on-chain tier provides neutral custody, public challenge, non-cooperative payout, and portable settlement history for cross-organizational trust assumptions.

  • Takeaways & Limitations

    Evaluation covers deterministic harnesses, local sandboxes, and local-chain deployment; managed infrastructure, production traffic, multi-party designs, and real adversarial economic conditions remain unvalidated.

Abstract

from arXiv · show

Autonomous agent runtimes execute tool actions that mutate databases, repositories, and cloud services across organizational boundaries. Authorization and local compensation cover pre-action admission and in-runtime rollback, but neither settles the residual harm left after a permitted action fails. We design Recourse, a smart-contract settlement protocol for compensable agent side effects that binds each admitted action to scope, recovery, evidence, payout, and collateral. Recourse separates ex ante eligibility from ex post objective settleability: typed receipts make objective residual claims computable under an optimistic-oracle challenge pattern, while subjective or incomplete claims route to ERC-792 arbitration or exclusion. We implement the contract suite, deploy it on Base Sepolia, build adapters against Postgres, Git, and cloud-compatible local sandboxes, and evaluate the system on a deterministic harness, sandbox traces, adversarial sweeps, and property-based fuzzing. Against authorization-only and local-compensation baselines, bonded coverage cuts uncompensated harm. The on-chain tier supplies neutral custody, public challenge, non-cooperative payout, and portable history under cross-organizational trust assumptions.

I. INTRODUCTION

Recourse addresses bounded residual harm after an admitted autonomous action fails, complementing authorization and local recovery with contract-based settlement. It defines eligibility and objective settleability, instantiates optimistic or arbitrated routing, and evaluates the resulting prototype.

  • Autonomous agents now mutate databases, repositories, cloud configuration, and administrative APIs across organizational boundaries.
  • Existing authorization, transactional compensation, task payment, approval, and centralized escrow mechanisms do not settle residual harm after an admitted action fails.These mechanisms address adjacent decisions, but none supplies the record needed to invoke recovery and compute payout.
  • Recourse binds eligible actions to resource scope, recovery, covered residual loss, payout, evidence, and required collateral before execution.After execution, typed effect and recovery receipts make payout computable from contract fields alone for objectively settleable instances.
  • Objective claims use optimistic settlement, while incomplete, subjective, or excluded claims route to arbitration or outside the model.The protocol covers bounded harms parties can evidence before execution; exfiltration, public leakage, irreversible transfers, and reputation damage remain excluded.
  • Recourse covers bounded residual loss for admitted actions, leaving authorization, workflow atomicity, and agent-quality guarantees to other mechanisms.
  • The design separates a boundary and routing discipline from cryptographic novelty, composing existing optimistic-oracle and arbitration primitives around a recovery-first bond vault.
  • Recourse provides a verified prototype, Base Sepolia deployment, provider-compatible adapters, adversarial evaluation, and property-based fuzzing.

II. BACKGROUND AND MOTIVATION

The paper distinguishes reversible, compensable, and excluded autonomous side effects, then routes post-failure settlement according to evidence, recovery, boundedness, and computability. Its trust model includes partially mistrusting participants and excludes several unbounded harms.

  • II. BACKGROUND AND MOTIVATION: Autonomous side effects divide into locally reversible actions, compensable actions with bounded measurable residual loss, and harms outside any pre-execution bound.
  • II. BACKGROUND AND MOTIVATION: Reversible actions use runtime or provider undo paths, while compensable actions require a contract, bond, bounded loss, and agreed evidence for reimbursement.
  • II. BACKGROUND AND MOTIVATION: Post-failure settlement routes reversible actions locally, compensable objective claims optimistically, covered non-objective claims to arbitration, and excluded actions to hard gates or approval.
  • II. BACKGROUND AND MOTIVATION: The model considers a customer, operator, and provider with partially mistrusting incentives, alongside potentially unavailable watchers and incomplete provider receipts.
  • II. BACKGROUND AND MOTIVATION: The protocol assumes smart-contract integrity on the underlying chain and excludes chain-level consensus failures.
  • II. BACKGROUND AND MOTIVATION: Objective settlement requires provider-signed receipts, snapshot references, or independently checkable restore artifacts; weak evidence routes to review.
  • II. BACKGROUND AND MOTIVATION: Exfiltration, public disclosure, irreversible transfers, and uncapped downstream effects remain outside the model regardless of a written payout cap.

III. ELIGIBILITY AND SETTLEABILITY

Recourse separates pre-execution eligibility from post-execution objective settleability. A router evaluates contract fields and typed effect/recovery receipts to choose optimistic settlement, arbitration, exclusion, or ineligibility.

  • III. ELIGIBILITY AND SETTLEABILITY: A recourse contract κ specifies the action template, resource scope, recovery operator, loss class, payout rule, bond, evidence schema, and deadlines.
  • III. ELIGIBILITY AND SETTLEABILITY: Eligibility is checked before execution against closed scope, available recovery, evidence provenance, measurable loss, total payout, and aggregate bond coverage.
  • III. ELIGIBILITY AND SETTLEABILITY: A failed instance σ combines the contract with effect evidence and recovery evidence describing execution, restoration, and residual outcome.
  • III. ELIGIBILITY AND SETTLEABILITY: Objective settleability requires in-scope typed receipts, invokable recovery, evidence that measures or caps the contracted loss, and a bounded payout computable from contract fields alone.
  • III. ELIGIBILITY AND SETTLEABILITY: The routing predicate checks scope, evidence, recovery, residual, and exclusion conditions jointly.
  • III. ELIGIBILITY AND SETTLEABILITY: The router returns ineligible for failed contract checks, excluded for scope, residual, or exclusion failures, optimistic when all settlement predicates hold, and arbitrated otherwise for covered claims.
  • III. ELIGIBILITY AND SETTLEABILITY: Table I maps settleability predicates to contract fields, receipt checks, settlement routes, and a named-schema Postgres over-delete with snapshot restoration.

IV. SYSTEM DESIGN

Recourse divides responsibilities between runtime execution and on-chain settlement, using machine-checkable contracts and neutral collateral to determine eligibility and payout.

  • Architecture: Recourse splits responsibilities between runtime components and on-chain contracts, including the classifier, adapters, compensator, vault, claim registry, oracle, and arbitrator.The five-phase protocol registers κ, admits execution, records effects and recovery, then settles through optimistic or arbitrated paths.
  • Contract admission: Eligibility requires one machine-checkable contract per action-template and resource-scope pair, with fields fixing effect, payout, bond, recovery, evidence, and deadlines.Contracts fail admission when scope is too broad, payout is too vague, or required objective evidence cannot be produced.
  • Evidence: Receipt provenance determines whether evidence satisfies the level declared in κ and therefore which settlement route remains available.Table II defines provenance levels, while EVIDENCEOK checks receipts against the declared level.
  • Collateral: The BondVault locks collateral separately from service-fee escrow and prevents either operator or customer from unilaterally controlling release.Admission requires locked collateral to cover open exposure plus the contract’s maximum payout.

B. Receipts and Recovery-First Workflow

Recourse records tool effects and recovery outcomes as signed receipts, runs recovery before payout, and routes claims according to objective evidence, computability, and challenge conditions.

  • Receipts: Signed EffectReceipts bind each action to its contract, job, intent, resource, state digests, timestamp, and adapter signature.Receipt provenance ranges across four levels, with contracts declaring the level accepted by EVIDENCEOK.
  • Recovery-first workflow: Recovery runs before payout, producing a RecoveryReceipt with restore artifacts, outcome, residual measurements, evidence source, and timestamps.Together, effect and recovery receipts provide the inputs to P(o, r), leaving payout to cover residual harm after restoration.
  • Settlement routing: Objective claims use an assertion bond and challenge window, while missing evidence, computability failures, or other failed predicates route claims to arbitration or exclusion.The runtime executes off-chain before claims enter the challenge window, and exposure is bounded by eventual payout.
  • Disputes: A valid claim cannot be drained by a malicious challenger because ERC-792/Kleros fee shifting makes the losing disputant pay arbitration costs.The paper inherits this guarantee from the ERC-792/Kleros deployment rather than verifying it independently.
  • Watcher incentives: Watcher challenge incentives depend on p∗= (γ + c/ba)/(1 + γ), and absent economically motivated monitoring leaves claims exposed to ABSENT_CHALLENGER loss.With matched bonds and negligible inspection cost, the threshold approaches 0.5; the protocol does not provision or subsidize watchers.

VI. PROTOTYPE IMPLEMENTATION

The prototype implements Recourse as a Solidity settlement suite with workload adapters and a classifier, while accounting for integration and evidence-retention burdens.

  • Prototype architecture: The implementation combines registry, bond-vault, claim-registry, optimistic-path, and arbitrable-path contracts with runtime adapters for Postgres, Git, and cloud-compatible sandboxes.Receipts use EIP-712 signatures, while large artifacts remain in content-addressed storage and their commitments stay on chain.
  • Deployment: The contract suite runs on Base Sepolia with live Circle USDC and UMA OOv3, while Kleros is replaced by a mock arbitrator because it lacks a Base Sepolia deployment.Five sample contracts register on a local development chain at a mean of 552 k gas each.
  • Onboarding: Onboarding defines scope, registers a recovery operator, chooses a capped closed-form payout, sizes the bond, and completes a one-time integration per action-template and scope pair.Scope must be tight enough for WITHINSCOPE to use an EffectReceipt resource id alone, and payout computes from receipt fields.
  • Operational boundary: Ongoing operation must keep compensators callable, adapter signing keys secured, and evidence retention longer than ∆.Stale compensators or expired retention lower receipt provenance and can move claims from optimistic settlement toward arbitration or contract-default handling.

VII. EVALUATION

The evaluation combines deterministic harness experiments, sandbox integration, on-chain cost measurements, adversarial tests, and fuzzing to assess Recourse across five research questions. It uses shared traces and metric extractors, with RQ4 limited to three provider-compatible local environments.

  • Evaluation design: Five research questions assess harm reduction, routing, adversarial robustness, sandbox receipt verification, and settlement cost or autonomy.RQ1–RQ3 and RQ5 use a deterministic synthetic harness; RQ4 is limited to three provider-compatible local environments.
  • Evaluation design: The harness uses a fixed seed, 24–60 calls per cell, five repetitions, and headline cross-checks over 10 base seeds.The cross-check uses Student-t 95% confidence intervals over 50 resulting sample points.
  • Evaluation design: Table IV reports gross, recovered, covered, and uncompensated harm per baseline in normalized Postgres-harness units.The table reports means from five deterministic repetitions.
  • Evaluation design: Table V ablates normalized loss, objective-settlement share, false acceptance, and bond utilization in the Postgres harness.The ablation examines multiple outcome axes rather than loss alone.
  • Evaluation design: The Postgres contract uses a composite row-count and downtime payout, a $1,000 cap, and a 10×-cap bond.Trace units normalize one deleted row as one unit, and dollar amounts in κ are USDC.

A. RQ1: Loss Reduction and the Trust Model

Recourse reduces uncompensated harm while preserving centralized escrow’s payout outcome and adding distinct trust-model guarantees. Routing conforms to expected destinations, while robustness results expose bond, challenger, collusion, and correlated-failure boundaries.

  • Loss reduction: Recourse and centralized escrow execute 5,464 gross-harm units, recover 1,796, cover 1,198, and leave 2,470 uncompensated.Both systems use the same payout rule and produce identical loss numbers; they differ on trust-model guarantees.
  • Loss reduction: 49.8 % ± 12.6 pp less uncompensated harm separates Recourse and centralized escrow from authorization-plus-local-recovery across 10 seeds.The comparison is paired with a 95% confidence interval on the deterministic Postgres harness.
  • Routing correctness: Routing correctness is 1.0 for every injected fault class in the labeled suite, with subjective, observability, and recovery-evidence faults arbitrated and boundedness faults excluded.The two annotator disagreements were resolved against the protocol rules before the run, so the comparison measures conformance.
  • Routing correctness: Under fault-mixed traffic, recovery availability, evidence schema, and loss class each trigger on 26 % of rejected admissions, bond sufficiency on 9 %, and 13 % are admitted.Under nominal evidence, every admitted instance is eligible and every failure is objectively settleable.
  • Robustness: The adversarial sweep reports FR 1.00 and shortfall 0 for inflated claims after dispute, but absent challengers raise residual loss to 18,853.The latter is roughly five times the cooperative baseline; bond stress adds 5.4 % ± 1.3 pp to baseline shortfall.
  • Robustness: A 1×-cap bond is the threshold: 0.5× leaks 6,260 units, while properly bonded operators plateau at 4,760 and utilization falls from 0.67 to 0.03.The payout cap binds before the bond at 1× and above.
  • Robustness: The shared pool absorbs correlated bursts through k=8 with zero concurrent shortfall, then saturates at k=16 with shortfall 2,983.The evaluation therefore sizes the 10× bond against approximately ten concurrent claims, while calling the limit workload-specific.
  • Robustness: Classifier fuzzing finds no counterexamples across 800 Hypothesis examples; contract fuzzers pass 768 Foundry runs and stateful invariants hold across 384,000 calls.The three counts use different statistical units and are reported separately.

D. RQ4: Provider-Compatible Local Sandboxes

The local-sandbox evaluation exercises provider-compatible adapters across Postgres, Git, and cloud parameter storage, including admitted, rejected, and recovery-failure cases. Its evidence is limited to operator-controlled ephemeral environments, while future provenance upgrades require managed providers and independent attestation.

  • Sandbox evaluation: Postgres has 20 cells with 15 admitted and 5 scope-rejected, recovering 33 gross harm units to 17 residual.The adapter signs EIP-712 receipts for each case.
  • Sandbox evaluation: Git has 20 cells with 14 admitted and 6 rejected; recovery reduces 3,223 gross harm units to 1,398 residual.Of the admitted Git cases, 8 are reflog-recoverable and 6 are garbage-collection-unrecoverable.
  • Stress behavior: The correlated-burst sweep keeps concurrent shortfall at zero through k=8, then shows a jump when the shared pool saturates at k=16.The sweep uses p=0.3 and a 10× bond.
  • Sandbox evaluation: The cloud parameter-store workload has 20 cells, with 12 admitted, 8 rejected, and 12 gross harm units recovering to 6 residual.It runs against LocalStack SSM rather than a managed cloud provider.
  • Evidence boundary: The sandbox receipts are L2 evidence, establishing adapter and compensator operation but not independent third-party or provider attestation.The environments are ephemeral, single-machine, and fully operator-controlled.
  • Sandbox evaluation: Across three workloads, 19 of 60 cells (31.7 %) are rejected on concrete scope violations, while admitted cells exercise successful and failed recovery paths.The workloads use Docker Postgres, a local bare Git repository, and a LocalStack SSM instance.

E. RQ5: Deployability

The deployability evaluation demonstrates end-to-end settlement on Base Sepolia and measures bounded execution cost, while distinguishing illustrative gas conversions from transaction costs. Its evidence does not establish mainnet adversarial performance, real collateral economics, production-provider behavior, or contested-dispute operation.

  • On-chain cost: 1.854 M in-process call-gas supports happy-path settlement, versus 2.060 M for disputed settlement; claim submission dominates at 411 k.Contract registration is a one-time 578 k, and the figures exclude deployment, setup, token preparation, and view calls.
  • Deployment validation: Base Sepolia independently verifies bytecode for all six contracts and confirms live Circle USDC and UMA OOv3 references rather than placeholders.Verification does not require the deployer’s private key.
  • On-chain cost: At 50 gwei and ETH $3,000, illustrative Base-mainnet conversions are $278 happy, $309 disputed, and $87 for one-time registration.These are conversions of local call-gas totals and exclude transaction overhead, L1 data fees, oracle and arbitrator fees, and locked-collateral opportunity cost.
  • On-chain cost: The $278 happy-path Base-mainnet estimate is 28 % of the $1,000 Postgres payout cap, while the $309 disputed estimate is 31 %.Gas is flat per claim, so overhead becomes a smaller share as covered-value caps increase.
  • Capital and performance: Locked bond averages 36 units at 0.67 utilization on Postgres, while residual loss outside the payout schedule appears as 4,595 shortfall.Losses above the cap remain outside the guarantee, and under-bonding beyond 1× the cap leaks loss.
  • Scope boundary: Base Sepolia validates correctness and gas cost, not mainnet adversarial pressure, real collateral economics, production traffic, watcher participation, or genuinely contested disputes.The provider adapters run against local sandboxes rather than managed infrastructure.

VIII. RELATED WORK

Related work covers authorization, rollback, payment, insurance, standards, optimistic bonds, and oracle mechanisms. Recourse distinguishes itself by targeting bounded residual loss after an admitted autonomous action and routing it through scope, evidence, payout, and collateral rules.

  • Authorization and compensation: Prior authorization and workflow mechanisms gate calls, roll back aborted workflows, or prevent replay hazards, but leave residual harm after admitted actions outside their scope.The comparison includes OAP, Atomix, Sagas, and ACRFence.
  • Adjacent settlement systems: Payment, insurance, identity, authorization, and SLA systems settle adjacent objects, whereas Recourse settles action-level harm rather than task payment, transactions, trust, identity, or SLA KPIs.Agent Contracts covers a wider object than Recourse.
  • Bonded protocols and oracles: Recourse uses established optimistic-bond and arbitration components, including UMA OOv3 and ERC-792/1497, rather than introducing a new cryptographic primitive.The bonded challenge pattern traces to Truebit and rollup fraud proofs.
  • Bonded protocols and oracles: Oracle and attestation systems such as DECO and Town Crier can synthesize higher-provenance receipts when providers do not natively sign them.Receipt provenance determines whether objective settlement is possible.
  • Positioning: Recourse targets bounded residual loss after an admitted autonomous action, binds it to scope, recovery, evidence, payout, and collateral, and settles on-chain within a bounded gas budget.The evaluation reports substantial harm reduction in the Postgres harness and failure routing through UMA/Kleros paths.
Loading 2609.01939v1…