AER Police: Aeredium's containment layer for financial agents

Short answer

AER Police is the product name Aeredium introduced in its July 2 AMA for policy and containment around autonomous agents. In the newer AER360 product map, the integrated agent component is instead called the Agent Control Center.

The live AERPOLICE website expands that into three operating verbs: Bind, Govern, and Prove. Bind means every agent gets its own AERKey-backed cryptographic identity. Govern means every proposed action is checked against policy before execution. Prove means every decision, approval, and transaction becomes a signed audit record.

The website, ACI self-assessment, report flow, and early-adopter registration are public. The July 30 AMA says AER Police is timely because AI agents can be attacked or manipulated, and frames the product as a policy/governance layer for agents that can touch money. The site still provides no public customer names, named partners, adoption numbers, pricing, contract addresses, independent audits, or production usage metrics.

Agent Control Center does not automatically mean AER Police was renamed

AER360 describes an owner creating child wallets so each agent has exactly one wallet and one policy. Each wallet uses one of twelve stated policy templates, with amount, frequency, and counterparty limits enforced as conditions of signature.

The number twelve appears in both products but refers to different things. AER360 states twelve agent policy templates. The AER Police ACI has twelve assessment questions across six scored layers. They should not be combined or treated as the same catalogue.

Why agents need containment

Eitan's July 2 explanation draws a useful line between chat apps and agents. ChatGPT, Claude, Gemini, and similar products are interfaces to LLMs. An agent goes further: it uses the model to decide, call tools, write code, query systems, and act through APIs or MCP servers. That autonomy is the point, but it also creates new attack surfaces.

How Aeredium says AER Police fits the stack

The key claim is that agent controls should be enforced at the signing and policy layer, not only in application code. That maps directly to AERKey: threshold signing, policy evaluation inside the signing path, audit trails, selective disclosure, and no complete private key held by one party.

In practical terms, an agent that wants to move funds should not simply hold a wallet key. It should request authorization under policy: limits, whitelisted destinations, velocity controls, approval thresholds, and recoverability rules. In that model, if policy fails, the signing path should refuse the request rather than producing a valid signature.

The July 2 AMA also connects this to Aeredium's throughput thesis. Eitan argued that agents will transact 24/7 and at machine speed, so settlement infrastructure must be instant enough for high-frequency trading, arbitrage, treasury management, stablecoin payments, and cross-border flows.

Where Aeredium enters the flow: the July 23 AMA gave two modes: an agent-only execution stack and an independent policy-engine mode. The July 30 AMA adds the adoption thesis: this is relevant wherever institutions let agents touch money, because the policy layer needs to survive confused-agent behavior, prompt injection, and hostile tool contexts.

Policy checks, approvals, containment decisions, and audit traces should not be assumed to consume AERX gas by themselves. A protected action becomes an Aeredium transaction, and therefore consumes AERX gas, when execution or settlement is submitted on-chain. The exact policy-audit boundary still needs formal documentation.

The audit lifecycle was described as recording the requested signature, its purpose, the policy evaluated, threshold participation, and the resulting action. Albert said that anchoring this record on-chain would be possible, but he and Eitan did not describe it as a current requirement. The public page should therefore not imply that every policy decision or audit event is already anchored to Aeredium.

Albert also said policies run inside an enclave. That is the team's security design claim, not independent proof that policies are immutable. The AMA's stronger statements about complete prompt-injection protection and being "fully covered" should not be treated as verified security guarantees.

Platform mechanics from the AERPOLICE site

The official site is more specific than the AMA. It says AERPOLICE sits between agents and the systems they act on, and that every proposed action becomes a Pact: a signed unit of intent that is evaluated before it touches the outside world.

The platform page also names MCP tools exposed to agents: list_roles, propose_pact, get_pact, submit_transaction, and get_wallet_state. That means the product is being presented as infrastructure an agent can call directly, not just a dashboard for humans.

Agent Containment Index

The ACI page is live as a browser-scored self-assessment. It positions OWASP LLM Top 10 and MITRE ATLAS as attack catalogs, then frames ACI as the companion score for what happens after an attack lands: whether the agent stack contains the blast before money or systems are touched.

The site says the assessment has twelve questions across six scored layers. The first layer, input semantic filtering, is explicitly described as a separate crowded market that AERPOLICE does not provide. The six ACI-scored layers are fail-open behavior, key extraction, approve-then-mutate risk, limits as enforcement, atomicity, and audit tamper-evidence.

ACI is not proof that a project is safe. It is a diagnostic starting point. Treat it as an Aeredium product framework, not an independent certification standard, unless third-party validation appears later.

Evidence limits

• The public AERPOLICE site is live, but it does not publish named customers, named partners, audit reports, production usage metrics, pricing, or contract addresses.
• The live AERPOLICE site says design and distribution partner conversations are open with enterprise software platforms, robotics companies, agent harness/platform builders, and systems-of-record owners, but it does not name those parties.
• The platform and about pages include draft or vision-level labels, so implementation details should be treated as product positioning until formal technical documentation, audits, or deployments are published.
• Agent Control Center is the current name used inside AER360, while AER Police remains a separate public product name. No rename, retirement, or merger statement was identified.
• The twelve AER360 policy templates are not the twelve questions in the AER Police Agent Containment Index.
• The July 23 architecture explanation expands AER Police into agent-wallet and independent-policy-engine modes; AER360 now provides a more concrete child-wallet model. Formal technical documentation still needs to define the boundary.
• Claims of 100% prompt-injection protection or complete coverage are not independently substantiated and are not adopted as this site's wording.

Sources

FAQ