Wyatt checks every consequential action an AI agent is about to take. It confirms the agent’s claims against the records they rest on, reads the request behind the action for signs of compromise or manipulation, and then allows the action, holds it for a person, or refuses it.
Assay opens the record an agent cites, compares it with what the agent claims, and refuses the action when the two disagree. It reads carrier scans, verification results, data sources and blockchain transactions.
Lexica reads the message an agent is acting on, where no record can settle the question. It flags the patterns of manipulated and compromised requests, and it sends those actions to a person. Lexica never refuses an action.
Agents that move money work on open ground: new rails, new kinds of actor, and very few rules anyone enforces yet. Wyatt takes its name and its star from Wyatt Earp, the frontier lawman. The job we borrow from him is the one a good sheriff does. He keeps the road open, lets honest traffic ride through without stopping it, and steps in only when something is actually wrong.
So Wyatt starts from yes. It allows an action the moment the record supports it, and it stays out of the way of the ordinary work agents do all day. It steps in when a record contradicts the agent, or when the request behind an action reads as compromised or malicious, and every time it steps in it says why.
Wyatt lets supported actions through at once. It never slows honest traffic to prove it is watching.
Wyatt holds or refuses only on something it can name: a record that disagrees, or a request built like a manipulation.
Every intervention arrives with the record it read, the words that raised attention, and the rules that decided.
Teams give agents permissions: which tools they may call, how much they may spend, which accounts they may touch. Permissions answer whether an agent may act. They never ask whether the agent has the facts right, or whether someone is steering it.
An agent summarises a record and reports something the record does not say. It approves a refund on a parcel the carrier shows as delivered, or presents an estimate as a measured figure. The action looks valid, and it rests on a claim nobody checked.
A customer pressures a support agent, a forged email redirects a payment, an instruction hidden in a web page tells an agent to transfer funds. The agent works exactly as built and does the wrong thing, because the request itself was compromised or malicious.
Every proposed action arrives with the agent’s claims and the records it cites. Where a record can settle a claim, Assay compares them. Where no record can, Lexica reads the request in the words the person or system actually sent, and a person decides.
Dashed boxes sit outside Wyatt. Only Assay refuses, and only against a record. Wyatt enforces that limit in its routing table, so no reading of anyone’s words can refuse an action on its own.
The record supports the claim. The action runs.
The agent reported honestly, but a narrower action fits. Wyatt names it.
Wyatt queues the action for a person and leaves it running.
Wyatt stops the action until a person or a better record clears it.
The record contradicts the claim. The action does not run.
Each industry brings its own records for Assay and its own list of honest behaviour Lexica must never count. The engines stay the same.
Assay reads the original transaction from Base before an agent resends, refunds or retries. Lexica reads the instruction behind a payment to a new address. Wyatt for Base
Assay checks a delivery claim against the carrier’s own scan. Lexica reads the customer’s message when they say an item arrived damaged, which no record can settle.
Assay checks a reported verification against the verification service’s receipt, and refuses an export that presents a modelled population as a measured one.
People who want something believed build their account in recognisable ways: urgency that leaves no time to check, authority nobody can confirm, pressure that raises the cost of saying no, detail missing exactly where someone could verify it. Lexica reads for those patterns and for the ones that point the other way.
Honestly I swear someone took it and I need this refunded right now or I will sue, I am not the kind of person who complains but this is unacceptable, believe me.
Lexica also runs Wyatt’s consumer app, which has roughly ten thousand users. Each industry gets its own list of honest behaviour that looks like a marker, and Lexica shows every marker it suppressed, struck through, with the reason.
The same input returns the same verdict.
Wyatt calls no model and no network to decide. A test holds that, and another fails if a network library ever enters the decision path.
Every verdict names its rules.
Wyatt derives the version from a digest of the rule tables themselves, so the label cannot drift from the rules that decided.
11 of 13 attacks stopped.
The red team suite prints the two it misses next to the eleven it stops, along with the attacks a gateway cannot see at all.