Does AgentGuard bound Buzz agents?

Yes, through the buzz-acp harness.

Buzz already gives agents a real trust layer: per-agent keypairs, owner-signed authorizations scoped to what an agent may do, delegation, revocation, and an accounting spec that records cost. What it does not yet carry is enforcement on the economics of an action at the moment it runs. AgentGuard adds that, wired in through one environment variable.

Where the seam is

Buzz built authorization and authorship. An agent has an identity, an owner can grant it a narrowly scoped authorization, that grant is cryptographic and revocable, and every action is signed so authorship survives delegation. That is genuine trust infrastructure, and it is not the part that is missing. What Buzz does not yet do is enforce a policy on the economics of an action while it happens: there is no spend cap, no capability ceiling, no runtime refusal when a call would cross a budget or a tier, and no signed receipt of that decision as a product surface. Authorization says who may act. Accounting records what it cost. Between those two sits enforcement, and that is the seam AgentGuard fills.

Buzz built authorization and authorship. AgentGuard is the enforcement between them.

The plug-in point is already there

The buzz-acp harness (the adapter that runs Goose, Codex, or Claude as Buzz agents) exposes an optional MCP server to the agent through one env var, BUZZ_ACP_MCP_COMMAND. Point it at AgentGuard and the agent sees the spend and action gate as regular MCP tools. No fork, no patch, no new event kind.

One real detail: the harness forwards that value as a single command with no arguments, so a multi-word npx line will not spawn as-is. Wrap it in a one-line launcher. That is a wrapper script, not a change to Buzz.

Setup

# 1. mint the agent's Buzz identity
cargo run -p buzz-admin -- mint-token \
  --name "bounded-agent" --scopes "messages:read,messages:write,channels:read"

# 2. launcher the harness can spawn with no args (agentguard-mcp.sh)
#!/usr/bin/env bash
exec npx -y @agentguard-run/mcp

# 3. point buzz-acp at it, then run the agent as usual
export BUZZ_ACP_MCP_COMMAND="$PWD/agentguard-mcp.sh"

Set the policy: a five dollar per-day cap and a read-only capability ceiling. Now every decision the Buzz agent makes passes the gate first.

Three runs

An owner can authorize an agent to transact. Enforcement is the separate question of whether this specific call, right now, is within budget and within its tier. These are the exact decisions the published SDK returns, captured from a real run.

ALLOWED · summarize this channel
within budget (call ~$0.02), capability sufficient · receipt seq 0 signed
REFUSED · buy $400 of OpenAI credits
Cap 'per_day=500c' exceeded (spent=0c, +call=2000c, total=2000c) · receipt seq 1
REFUSED · wire $9,000 to a vendor
Capability 'read_only' below required 'payment_execute' · receipt seq 2

Verify it yourself

Each decision signs a receipt into a hash-linked chain that verifies offline. Turn a refusal into an allow and verification fails at that exact entry.

$ npx @agentguard-run/spend verify --trace latest
✓ full chain valid ✓ signatures match ✓ no sequence gaps

What the agent carries out

Bounded by AgentGuardverified
agent
buzz bounded-agent
cap
$5.00 / day
ceiling
read_only
receipts
seq 0 to 2, chain valid

Reproduce it: @agentguard-run/mcp and @agentguard-run/spend are on npm, open source. Buzz is github.com/block/buzz. Try the same three actions in the homepage playground, or reach us at [email protected].