Fail closed
Missing evidence, an unavailable model, an unknown signer, or an unsafe proposal becomes a refer/reject state.
Security boundary
Make the unsafe path boring.
LoomCredit treats verification, intelligence, policy, and capital as separate capabilities with explicit handoffs and failure states.
Four boundaries around one action.
- Source evidence: successful receipt, trusted emitter, exact topics/data, and replay key.
- Agent output: Zod schema, evidence ID binding, deterministic policy evaluation, and REFER on missing model/evidence.
- RiskGuard: EIP-712 signer allowlist, nonce replay guard, expiry, advance cap, guarantee ratio, tenor, buyer concentration, state, and liquidity checks.
- Capital: the demo vault is accounting-only test liquidity; it cannot withdraw a real user's funds.
- Browser boundary: baseline response headers prevent framing, MIME sniffing, unnecessary referrer leakage, and unused browser capabilities. Authentication write routes also apply a bounded single-instance rate limit; a trusted distributed edge remains required for scaled deployments.
Truth is a feature.
- No production lending product or investment offer is active.
- No live proof response or deployed contract address is embedded in the local browser application.
- No model response is fabricated when the model environment is missing.
- No transaction is called by the browser policy lab.
Least privilege
The agent proposes. The policy contract decides. The testnet vault records reservations without custody.
Known limitations
Live deployment, funded wallet, source escrow, prover availability, and end-to-end transaction evidence remain external setup work.