{"id":"agent.pass.v2","title":"Agent Pass, v2: the six v1 checks plus a 90-day memory of harm and a month in character","unit":"one signed document per issuance; valid 3 hours; revocable","chain_set":"eip155:8453 (Base)","window":"issue time for the live checks; the last 90 days for harm-kind detections; the last 30 days of counted payments for the pattern check; the level's own as_of","definition":"A v2 Pass is issued for a registration when, at issue time, every v1 check holds (published level L7 or above; no open harm-kind incident; a counted payment in the last 30 days; the newest counted payment scored none under behaviour.out_of_character.v2 or fewer than 3 prior payments with the check recorded as not taken; no bound wallet on an issuer freeze list; no standing unlimited ERC-20 approval to a plain key) and, in addition, no harm-kind detection or incident (drain_pattern, test_then_drain, address_poisoning_loss, bind_closed_after_nft_transfer) was logged against the agent in the last 90 days, open or closed, and no counted payment of the last 30 days scored notable or major under behaviour.out_of_character.v2. Body, signature, expiry, log and revocation as in agent.pass.v1.","method":"As agent.pass.v1, plus a read of the detections log for the agent over 90 days and the scores of its last 30 days of counted payments (pulse-oochar's payment_score rows). On the lab dataset (pass/ISSUANCE.md): 0 of 17 drained agents hold a v2 Pass (14 of 17 held a v1 Pass); 352 of 500 controls hold one (354 under v1); 68.1% of all 517 (71.2% under v1).","excludes":["As agent.pass.v1.","Detections older than 90 days (the memory is bounded on purpose, so an agent can earn the Pass back)."],"does_not_assert":["As agent.pass.v1.","That a detection in the window was a loss: a hand-off to the operator's own next wallet scores the same and counts the same; the Pass reads the ledger, not a judgement."],"assumptions":["As agent.pass.v1.","The detections log is complete for the four harm kinds over 90 days, and the scoring worker has scored every counted payment of the last 30 days before issuance."],"known_gaps":["The 30-day pattern check inherits the signal's false-alarm rate (0.78 notable alerts per control agent-year under v2 on full data): 2 of the 354 controls v1 passed (a third already failed v1's in_character) control agents a month lose the Pass for a payment that was theirs to make.","A revoked Pass restarts the 90-day clock under this draft; whether it should is open."],"intended_use":"As agent.pass.v1, for counterparties that want the statement to remember a drain for a season rather than three hours.","not_intended_for":"As agent.pass.v1.","cost_to_fake":"As agent.pass.v1, plus 90 clean days after any detection: a drained or draining registration cannot hold the Pass again until a quarter has passed without a harm-kind detection, and a new registration needs 30 days of counted payments in character before its first v2 Pass.","threat_model":"Assume the model behind an agent can be steered by text it reads (a prompt injection, a poisoned tool result, a planted memory): every signal here is measured from the chain and our ledger, never from what the agent says, and nothing here is a verdict on an agent, an operator or a person.","supersedes":"agent.pass.v1","source":"afg-security-lab pass/ (CRITERIA.md §v2, issuance.mjs, ISSUANCE.md), 2026-10-14; production: AFG-Pulse (afg-oochar, afg-intake gate routes), 16 Oct 2026","since":"2026-10-16","status":"registered 16 Oct 2026; issued in shadow (unsigned rows) first","revisions":[],"body_sha256":"1db6440f06db43ad8f06feea9ac3d55f21f68e64094d9195940184c68f8fe5a0","url":"https://agenticfinancegraph.com/def/agent.pass.v2","ladder":"https://agenticfinancegraph.com/ai-agent-liveness-methodology-l0-l9-ladder","license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}