Aleph Hackathon 2026 · WDK Track
AI can propose payments. It can’t decide where your money goes.
The limits live in the Tether WDK policy engine, out of the model’s reach.
A six-beat animation. One: a payroll file arrives with an instruction typed into one of its cells. Two: the agent reads it and proposes 12 payments, holding no key. Three: every proposed line runs into the WDK policy engine and its five rules. Four: 7 approved, 2 blocked by name, 3 not attempted, and the injected line is refused. Five: the receipt balances — 7 plus 2 plus 3 equals 12 — and the injected line was paid nothing. Six: an agent connected over MCP gets 9 tools and not the 2 that would move money; the most it can obtain is a voucher, which a person approves by typing a command the model cannot reach.
01An agent reads a payroll faster than we do.
02A payroll can argue back — one cell is enough.
03A limit in a prompt is a request. In code, it is a control.
One payroll, 12 lines
Dry run on sepolia · every figure from the receipt
authorised
stopped before a transaction existed
Three layers. Only one decides.
AI
A schema-validated plan. No key, no transfer, no sign.
Cerrojo
Five offline rules and a daily counter. Refusing costs no network.
WDK
Default-deny wallet. Only authorised lines reach it.
Manipulate the agent. The lock still holds.
Same payroll, three cells rewritten to attack the model. Identical verdict on all 12 lines.
Reads the payroll, writes a plan
No key, no limits, no way to send.
Refused by rule
The rules live in code the model cannot reach.
Never called
No transaction exists to undo.
The agent channel · MCP
Give the agent a wallet. Don’t give it a key.
Cerrojo is an MCP server too. Point Claude Code or Claude Desktop at it and the agent gets 9 tools — none of which can move a cent.
stdio or HTTP
So the most an agent can do is ask
The agent
Judged on the spot. A denied order never becomes a voucher.
The voucher
Fifteen minutes, under a sha256 of the order.
A person
Typed in a terminal the model cannot reach. The policies run again.
Proposing and approving are different programs, and only one of them has a person in it. A prompt cannot pay itself.
See every tool, and a real session →On chain · Sepolia
And once, a person said yes.
A lock that has never opened is not a lock anyone should believe in. So it was opened exactly once, through the longest path in the system, and here is the hash.
sepolia · block 11,548,511 · fee 109494023762340 wei
An agent proposed it over MCP
cerrojo_proponer_pago returned a voucher, not a payment.
A person approved it in a terminal
The only place in the system where approving exists.
The policy engine was asked again
Re-validated ALLOW at approval time, not at proposal time.
WDK signed and broadcast it
account.transfer, reached only by an authorised line.
The command a person typed: node src/cli.js aprobar vale_2026-08-23T07-16-53-548Z_d4c15f --live --confirmo. The engine answered ALLOW again at approval. It is the only transfer this treasury has ever made.
Built on Tether WDK
WDK holds the wallet. Cerrojo controls what reaches it.
cerrojo paridad hands Tether's own wdk CLI only approved lines. That CLI has no cap and no allowlist — which is why the lock sits in front of it.