Orvyn, by Tenet

Buyer protection for AI agents that buy.

An agent that buys for a person pays through Orvyn. The money goes into an escrow on Arc, not straight to the store.

Connect an agent How it works
  • Escrow on Arc
  • Judge on GenLayer
  • MCP server, any client
01

What Orvyn is

An agent pays through Orvyn into an escrow on Arc, not straight to the store. If the owner reports a problem, the agent opens a claim and a judge on GenLayer decides.

session key

Limits on chain.

The agent signs with a session key that can only pay the escrow.

rules.json · claims

The owner decides what matters.

Rules say which claims the agent opens alone and which need the owner.

verdict

A judge, not the store, decides.

Tenet's judge on GenLayer decides under the store's terms, settled on Arc.

02

How it works

  1. 01

    The owner sets rules and approves the agent's session key for one day with the owner's tool (see Session key).

    owner's tool
  2. 02

    The agent places an order at a store that sells through Tenet Pay and gets a payment link.

  3. 03

    The agent calls pay_link. Orvyn checks the owner's rules and the store's terms against the escrow, then pays. The money is held in escrow.

    pay_link
  4. 04

    If something goes wrong, the agent calls open_claim. For "not as described", Orvyn asks the owner for the proof through MCP elicitation.

    open_claim
  5. 05

    The store has a window to answer. The judge decides; the result is settled on Arc.

    store's window Judge · GenLayer
  6. 06

    The agent calls withdraw and the refund goes back to the owner's account.

    withdraw
03

Connect an agent

Orvyn is an MCP server (stdio). Any MCP client can use it. A client that supports elicitation can ask the owner; without it, claims that need the owner are not opened.

The server runs under Node's permission model: it can read only its own folder, the session key, the owner's approval and its ledger. Node 24 takes one --allow-fs-read per path.

VariableWhat it is
MCP client config paths are placeholders 

      

    

  







  

    

      04
      

        
The six tools

        
The owner has 10 minutes to answer a question from Orvyn. With no answer, nothing is signed and the agent is told the step waits for the owner.

      

    

    

  







  

    

      05
      

        
The owner's rules

        
Applied in code before anything is signed. The limit per order and the number of orders are also on chain (see Session key); the daily total and the weekly claims are counted in code.

      

    

    

      

        

          
FieldMeaning

          

        

      

      

        

          rules.json
          
        

        

      

    

  







  

    

      06
      

        
The session key and its limits on Arc

        
The owner's account is an ERC-4337 smart account (ZeroDev Kernel 3.3, EntryPoint 0.7). The agent never holds the owner's key. It signs with a session key that the owner approved, and the chain enforces what that key may do.

      

    


    

      

        
pay
Pay permission

        
    
          
  • approve USDC to the escrow only, up to the limit per order;
    • 
          
  • pay into the escrow in USDC only, up to the limit per order;
    • 
          
  • a number of orders per key, counted from the time it was issued;
    • 
          
  • an end date (one day);
    • 
          
  • a gas budget;
    • 
          
  • no native value.
    • 
        

      

      

        
claims
Claims permission

        
    
          
  • open a claim, submit evidence and withdraw USDC on the escrow, nothing else;
    • 
          
  • an end date and a gas budget; no native value.
    • 
        

        

          How the owner approves a key
          
The agent creates a session key and gives the owner only its address. The owner's tool signs an approval with the limits. The approval holds no private key. On a local fork of Arc, an approval with a limit changed by the agent was refused by the chain.

        

      

    


    

      
      

        Keep the owner's key on another device or a hardware wallet, never on the agent's machine.
        Today the owner's tool reads the key from a file (testnet); signing the approval from a wallet or a hardware wallet is not built yet.
      

    


    

      

        

          
Refused on Arc testnet

          
Each was signed and simulated against the real network, and the policy refused it.

        

        
    
          
  • a USDC transfer to another address
    • 
          
  • an approve to another spender
    • 
          
  • an approve or pay above the limit per order
    • 
          
  • native value
    • 
          
  • a third order on a key approved for two
    • 
        

      

      

        

          
Refused on a local fork

          
The real contracts copied locally, not the live network.

        

        
    
          
  • the claims permission trying to pay or transfer
    • 
          
  • a withdraw of another token
    • 
          
  • a spent gas budget
    • 
          
  • a key past its end date
    • 
          
  • an approval with a limit changed
    • 
        

      

    

  







  
  

    

      07 · 
      
Demo: a real agent buys and claims

    


    


    

      

      

        

          
Owner

          

        

        

          
          
          
        

      

      

    


    


    
Both were settled on Arc: the full amounts went to the buyer and 0 to the store.


    


    

      A note on this run
      
    

  







  

    

      08
      
Network and contracts

      

    

    

      09
      
Status

      

        
Orvyn runs on Arc testnet with testnet USDC. There is no mainnet deployment.

        

          Not built yet
          
delivery verificationOrvyn does not check whether an order arrived; the owner says so. A late claim needs a delivery email verified by Lacre, which is not live on this network yet.

          
signing the owner's approval from a wallet or a hardware wallet

          
a daily USDC total on chainOn chain today: the limit per order, the number of orders, the end date and the gas budget.

          
mainnet

        

        
Dispute path tested on Arc testnet: the store disputed with a fact, the closing round ran and the judge decided DENY (claim not proven). See the transcript and the verdict.