{"id":"behaviour.out_of_character.v2","title":"Out-of-character payment, v2: v1 with a USD floor, a fresh-destination feature, ledger-wide payee counts, and re-weighted probe and 7702 reasons","unit":"per counted payment: a score in [0, ∞) with public reasons and a level (none, notable at 0.9, major at 1.4), plus the payee's ledger-wide popularity; per agent: v1's collective change labels","chain_set":"eip155:8453 (Base)","window":"the agent's whole counted-payment history before the payment under test (past only); block-pinned code reads; ledger-wide payee counts as of the export","definition":"As v1, with these fixed changes: the three amount reasons (amount out of distribution, new payee at a large amount, fresh destination at a new size) cannot fire under $20; a new reason, fresh_destination_at_new_size, holds when the payee was never paid before by this agent and the amount exceeds every earlier payment; probe_then_large alone reaches notable; the 7702-delegated-payee reason counts only beside another reason; independent payers use the ledger-wide count of distinct agents paying the payee (counted only when the payee was first seen before the payment); the ERC-20 approval half of the 24-hour change reason is computed from the ledger's approvals.","method":"docs/definitions/behaviour.out_of_character.v2.md, committed alone before any v2 run (84de8ac), with the base rates read before registration and the reason a popularity dampener was rejected (7 of 12 harmful payments went to payees hundreds of agents pay). Evaluated under the same pre-registered plan as v1 on the full histories, with v1-on-full-data, the drain rule and do-nothing as baselines; v2 is claimed better than v1 only if its false-alarm rate per agent-year is not worse and its recall on real positives is higher.","excludes":["As v1.","Payments under $20 from the amount reasons (they can still alert through the other reasons)."],"does_not_assert":["As v1.","That a popular payee is legitimate or an unpopular one is not."],"assumptions":["As v1.","The ledger-wide payee count is read as of the export; it can exceed what was known at the time of the payment and never understates."],"known_gaps":["Results: oochar/RESULTS-v2.md (filled by the registered run).","7702 delegation changes are not in the export, so the change reason is the approval half only.","The positives overlap the drain rule's own shape; the synthetic positive control and the control false-alarm rate are the independent evidence."],"intended_use":"As v1: a pattern to read at payment time; the in-character check of the Agent Pass; the signal section of a Gate policy (gate/policies/).","not_intended_for":"As v1.","cost_to_fake":"As v1; in addition, an attacker must send a first payment to a new payee under the agent's largest earlier payment (which the probe reason then watches), and cannot hide a large first payment to a never-paid key behind a wide amount band.","threat_model":"Assume the model behind an agent can be steered by text it reads (a prompt injection, a poisoned tool result, a planted memory): every signal here is measured from the chain and our ledger, never from what the agent says, and nothing here is a verdict on an agent, an operator or a person.","supersedes":"behaviour.out_of_character.v1","source":"afg-security-lab oochar/v2.mjs and docs/definitions/behaviour.out_of_character.v2.md, 2026-10-14; production: AFG-Pulse (afg-oochar, afg-intake gate routes), 16 Oct 2026","since":"2026-10-16","status":"shadow: computed for every counted payment of ranked agents since 16 Oct 2026 (afg-oochar); nothing blocks or alerts from it; the drain_pattern detector remains the published rule","revisions":[],"body_sha256":"ec6c774e2602686d6bcbf9a0f68e11b5a27f6119947ad2ccc5ed85c287880d46","url":"https://agenticfinancegraph.com/def/behaviour.out_of_character.v2","ladder":"https://agenticfinancegraph.com/ai-agent-liveness-methodology-l0-l9-ladder","license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}