Every agent that spends money needs someone to answer for it.
ENSO binds an agent to a legal entity, enforces a cryptographic mandate, and produces a tamper-evident record of every decision, revocable across platforms.
ENSO, the accountability layer for autonomous agents · Dmitry, founder
13 SLIDES · PRE-SEED
PROBLEM · 02
02 / 13
PROBLEM
Agents now act. Nobody can answer for them.
Everything being built for agents is about how an agent acts. Nothing is about what happens when it is wrong.
01 / ACTION
Agents act on real systems
Agents access systems, move money and bind companies to transactions. The rails are already live: Stripe, Google AP2 and x402 in production.
LIVE TODAY
02 / IDENTITY
Identity is verified. Liability is not.
Platforms verify an agent's identity, and still cannot say which company is liable for what it does.
THE GAP
03 / THE FALLBACK
So we keep a human in the loop
Today the only real answer is "keep a human in the loop", because the human carries the accountability.
THE COST
WHY NOW · 03
03 / 13
CITATIONS, NOT OPINIONS
Accountability is now a legal requirement, not a design choice.
LEGAL STANDARD
Liability runs to the entity
Baker McKenzie, June 2026: accountability "generally runs to the humans and entities behind the agent"; firms are "expected to govern, monitor and explain" agent actions.
2026
NO AUTONOMY DEFENCE
AI cannot be the defendant
A California statute bars the defence that AI autonomously caused the harm. A June 2026 executive order directs DOJ enforcement against the misuse of AI agents.
DOJ
MONEY MOVES FIRST
Rails are live before liability
x402 sits in the Linux Foundation; AP2 is in production with PayPal. Money moves before liability is solved.
x402
SOURCES · BAKER MCKENZIE (JUNE 2026) · CALIFORNIA STATUTE · JUNE 2026 EXECUTIVE ORDER · LINUX FOUNDATION / PAYPAL
SOLUTION · 04
04 / 13
Entity. Mandate. Record.
Three primitives, plus the kill switch that makes them mean something.
— 01 / ENTITY
A legal person behind every agent
Every agent is bound to a legal person with capital and jurisdiction. Not a developer profile, a counterparty you can serve notice to.
— 02 / MANDATE
Authority with hard limits
What the agent may do, up to what amount, until when. The limit lives in cryptography, not in an instruction.
— 03 / RECORD
Every decision, signed and chained
Every decision is signed, chained and tamper-evident, verifiable by any third party without access to our service.
— 04 / REVOCATION
Revoked across platforms
Revocation works across platforms, not inside one rail. The record is the receipt; revocation is the stop button.
HOW IT WORKS · 05
05 / 13
ONE CALL · THREE ANSWERS
A platform asks three questions, and gets three answers in one call.
PLATFORM RAIL
MANDATE
ENTITY + RECORD
QUESTION 01
Which entity is behind this agent, and is it attested?
→ entity / attested
QUESTION 02
What is it permitted to do, and what limit is left?
→ mandate / limit
QUESTION 03
What has it actually done, and is it still authorised?
→ record / revoked
RESPONSE · entity / mandate / record_root / revoked, verifiable by a third party that never talks to us.
LIVE PROOF · 06
06 / 13
LIVE PROOF
Not a pilot. In production, with real money.
A live agent acting with real capital, writing every decision into the attestation record as it goes.
LIVE · 01
A live agent, real capital
Running on mainnet with real money, not a sandbox with test balances.
LIVE · 02
Every decision on the record
Each decision is written to the attestation record as it is taken.
LIVE · 03
Publicly reachable
7rwvv-hqaaa-aaaaa-qhfa-cai.icp0.io
HONEST DISCLOSURE
The agent does not make trading profit. Its value is that it is an agent whose actions are answerable, the exact thing the market is missing.
METRICS · 07
07 / 13
METRICS, HONESTLY
Where we are, and what the next 30 days buy.
We start from zeros, not from projections. Zero without a plan is worse than zero with one, so here is the plan.
0
Attested decisions, counted
Signed and chained on the record. Today we do not publish a count.
+30 DAYS · 10,000+
1
Entities in the registry
Ours. No external user of the registry yet.
+30 DAYS · 5 PILOT ENTITIES
No
Public verify endpoint
The spec is ready; the endpoint is three weeks of work.
+30 DAYS · SHIPPED
0
Paying pilots
No paying customers today, at any price.
+30 DAYS · 1
DEFENSIBILITY · 08
08 / 13
DEFENSIBILITY · A 2026 MUST-HAVE
What we own that cannot be copied quickly.
THE HARDEST TEST
A live agent spending real money.
Our own agent spends real capital, so our records survive contact with reality rather than a sandbox.
01
System of record for agent accountability
The entity registry and the record format become the reference others verify against. Switching cost: every record re-issued.
02
Rail-agnostic revocation
We sit between rails. A rail cannot revoke a mandate outside itself.
03
Open spec as distribution
We publish the attestation and verify format so others implement it, distribution we cannot buy.
COMPETITION · 09
09 / 13
WHY NOT STRIPE, GOOGLE OR SKYFIRE
One structural reason: liability cannot live inside a rail.
01IDENTITY LAYERS
They tell you who.
Skyfire and Beltic verify an agent's identity, that answers who it is, not who is liable for what it does.
Identity is not liability: establishing the author is not appointing the answerable party.
We can sell to them as a supplier, not a competitor.
02PAYMENT RAILS
They collect consent.
Stripe, Google and AP2 collect user consent inside their own rails. Consent is not liability, and it does not travel.
A payments company cannot be the neutral arbiter of its own transactions, it is an interested party.
Regulators want an answer that survives the platform being switched off.
CONCLUSION · THAT ANSWER IS A NEUTRAL LAYER BETWEEN THE AGENT AND THE LAW. NOT A FEATURE OF A PROCESSOR.
ECONOMICS · 10
10 / 13
ECONOMICS
Price per agent, not per token.
Entity + Mandate + Record.
Annual, per agent. Revenue starts with one pilot, not with a platform licence.
STARTER
$2,500
/ YEAR
PLATFORM · MULTI-AGENT
$7,500
/ YEAR
PILOT
$15K–50K
ONE-OFF
GROSS MARGIN · CURRENT ARCHITECTURE
~95%
MARGINAL COST / ATTESTED DECISION
~$0, one linear write to a canister, with no inference cost per decision.
PRICED PER AGENT · NOT PER TOKEN
MARKET · 11
11 / 13
THE PAYING WEDGE
Not "all agents".
One segment, one budget line, one buyer with compliance exposure.
BOTTOM-UP · NO TAM PYRAMID
WHO PAYS
11 / 13
Platforms already letting third-party agents touch money and data, fintech and crypto first (Beltic's and Skyfire's own buyers), then insurers underwriting agent risk.
Fintech and crypto, where regulatory risk is already a paying line item.
Insurers and underwriters of agent risk, an almost empty niche where our record becomes the tariff.
Identity vendors as suppliers: they verify who, we supply the entity, authority and revocation.
ONE LAYER · ONE SENTENCE
TEAM · 12
12 / 13
WHO IS ACCOUNTABLE FOR ENSO
Dmitry — founder.
VP Decentralization at Haah.
OPERATOR, NOT A NARRATOR
WHAT HAS BEEN SHIPPED
12 / 13
01
Systems running today
ENSO live on mainnet; ARLI, a Rust research harness; an agent trading system operating with real capital.
02
Operating role
VP Decentralization at Haah, running decentralisation in production, not advising on it.
03
The gap we are closing now
A named legal and regulatory advisor. Selling accountability without a legal name in the room is our weakest point, we say it before it is asked.
WE NAME THE WEAK POINT BEFORE YOU DO
THE ASK · 13
13 / 13
PRE-SEED OR PILOT
Pre-seed $500K–1.5M, or a paid pilot.
Pre-seed because we are pre-revenue: 2026 benchmarks put seed at a $1M ARR baseline, and $0 ARR is acceptable only pre-seed.
ENSO · DMITRY · FOUNDER
04.10.2026
WHAT YOU GET
12 MONTHS
01
Use of funds
Attestation, public verify and outward revocation in three weeks; the first two pilots; one legal advisor; publisher of the open spec.
02
What you can check
Open a laptop and verify any of our agents yourself: entity, mandate, record root, revocation state.
03
12-month milestone
Five entities in the registry, one paying platform, and third-party verification by someone who is not us.