Documentation
How Sage works
The short answer. Sage is an AI agent that turns one product URL and one budget into paid, verified testing. It browses the product itself, designs the missions, judges what testers submit, and pays them in USDC on GOAT Network. Three separate model layers do the reasoning. None of them can move money — an on-chain vault computes every amount and enforces every limit, and it is the only thing that can release funds.
What does the agent actually do?
Five steps, in this order:
- Opens the product in a real headless browser and explores it — screenshots, rendered content, console errors, the states a visitor can actually reach.
- Designs testing missions from what it observed, not from the marketing copy.
- Real people complete those missions and submit written accounts.
- Checks each account against its own observations of the product.
- Pays in USDC, or refuses — with a written reason either way.
No human is in any of those five steps. The founder does exactly two things across the whole lifecycle: approve the plan, and fund it.
Why are there three separate model layers?
Because a single model that designs the work, judges the work and talks to the customer can be talked out of all three at once. They are split on purpose, and they do not share state.
| Layer | Job | What it is forbidden to do |
|---|---|---|
| Mission Brain | Designs missions from an inspected product — architect, then critic, then a deterministic validation gate | Ship anything the gate rejects. Model output is untrusted until it passes. |
| Payout brain | Judges tester evidence and proposes pay, review or hold | State an amount. Ever. |
| Concierge | The conversational front door on Telegram | Do its own money arithmetic, or import the judgment layer at all |
The concierge deliberately does not import the judging code, so a conversation can never perturb the layer that decides payouts. They share an LLM endpoint and nothing else.
What stops the agent from paying for bad work?
Several things, in layers, and the important ones are not made of prompts.
The evidence must be checkable. A tester’s account has to line up with what Sage itself saw while exploring, so a report that could have been written without opening the product does not clear. Any quote in a decision brief must be an exact substring of the fetched evidence — anything else is dropped before a human ever sees it.
Untrusted text stays marked as untrusted. Inspected pages, fetched evidence and submitter notes are wrapped in delimiters, and forged delimiters are stripped. A detector covering eight families of prompt injection runs over everything a stranger wrote.
Auto-payment is an AND-gate, not a judgement call. Confidence has to clear a fixed threshold, the reasoning engine has to be the real model rather than the fallback, and the fraud signals have to be clear. With no model available at all, the system degrades to a transparent keyword heuristic that cannot auto-pay anything — it can only hold work for review.
What happens if the model is jailbroken anyway?
It still cannot move money, because it was never the thing that moves money.
Each campaign’s budget sits in an on-chain vault. The vault derives the exact reward from the funded budget, enforces the per-mission cap and the completion limit, rejects replays, and emits the settlement event that is the single source of truth. A model output is a recommendation arriving at a contract that has its own opinion.
The budget itself is compiled deterministically: the sum of every possible payout equals exactly what was funded, to the base unit. Money that is never claimed is recoverable — stopping a campaign revokes the vault and returns the balance on-chain.
The agent proposes. The vault disposes. That sentence is the whole security model, and it is enforced by a contract rather than by careful behaviour.
Is there an agent loop running somewhere?
No — and that is deliberate. Autonomy here is a stateless gate with two triggers. A tester submits, and the decision pipeline runs once. Separately, an authenticated sweep re-evaluates pending work, settles matured approvals, and pays operator fees on a short cadence, with a lock that makes overlapping ticks harmless.
The pipeline never throws for control flow. Any failure resets the work to pending, so the next sweep picks it up. Nothing is lost because a request died halfway.
Can the founder be sure a payout really happened?
Every payout is a public transaction with a receipt page citing the evidence it was paid for. The payout ledger and the user feedback log are generated from production data rather than written by hand, so a reader can re-derive any figure we publish, and check every transaction on the network explorer without our cooperation.
Do I need a wallet?
No. @sagedeputybot runs the entire loop from Telegram: it creates a server wallet bound to a spending policy and funds the campaign from it, so you never connect anything or leave the chat. Or use a browser wallet on this site if you prefer one. Sage never holds your keys either way.
What Sage is not. It is not a generic agent platform, a chatbot, or a bug bounty. It is deliberately narrow: one product and one budget become paid, verified testing, and it is judged on whether the payouts hold up. Deep exploratory testing by a domain expert, and anything needing credentials a tester should never share, are still jobs for a person.