Intent first
The agent does not invent the payment. A trusted app or a limited mandate issues AuthorizedIntent before prepare runs.
SAI VAP
Agents prepare. They do not execute.
The protocol sits between a user-authorized request and a payment or chain call. Each step leaves a signed attestation. The execution path will not move without the full set.
Independent checks
Semantic and safety verifiers decode the payload themselves. An LLM confidence score is not a signature.
One frozen action
The gate recomputes hashes, checks roles, and claims the business key. A boolean in a database is not permission to send funds.