Safety and limits

The vault's limits

Every job has its own vault: a contract on chain that holds the job's budget. Sage's AI can only ask it to pay. The vault decides, by rules fixed when the job was created:

• It works out the reward itself, from the mission. A request to pay can't name an amount.
• Each mission pays no more people than it was created for, and each wallet at most once.
• The same approval can never be paid twice.
• It pays out no more than the job's budget, and no more than its daily limit.
• Only the operator named when the job was created can ask it to pay, and only its owner can take money out.
• Stop the job and the vault closes. Everything left goes back to whoever funded it: your wallet, or your Sage account.

A job goes live only after its vault is funded, so the rewards on the board are already paid for. When the vault says no, it doesn't fail silently: it records the refusal on chain, with a code for the reason.

Sage adds its own rules before it ever asks the vault, such as one payout per person across a whole job. Those live in Sage's code. The vault's limits hold even if that code is wrong.

What the AI can't do

• Set an amount. Rewards are fixed by arithmetic when the job is made. The judge isn't allowed to state an amount. The chat assistant never does its own money math: it passes on your numbers and Sage's, and Sage checks the plan against what you actually said.
• Invent a quote. Any quote in a decision must match the evidence exactly, or it is dropped.
• Take orders from the work. Pages, evidence and notes are wrapped as untrusted text before a model reads them, and a detector looks for eight kinds of prompt injection.
• Pay when it's unsure. Below the job's confidence bar, or with a serious sign of fraud, the work waits for a person.
• Pay on a guess. If no AI model is available, the judge falls back to a keyword check, and its verdicts wait for a person. Work can still clear only on checks that need no model at all.

So a jailbroken model can do one thing: recommend a payout. The vault still works out the amount, applies every limit, and can say no.

Farm defences

A payout only means something if one person can't collect it many times. Sage stacks several defences, from hard refusals to signals a person reviews.

• One person, one slot. On public work, claiming a slot can ask for a one-time World ID proof that you're a unique person. Sage keeps a number tied to that proof, never a name or a document. Every wallet that shares it, and every wallet linked on chain or declared as yours, counts as one person.
• Copies. Near-duplicate writing and copied pages are found by comparison and held for review.
• Linked wallets. Sage reads the chain to see when submitters were funded by each other, or by the same wallet.
• New wallets. A wallet with no history counts against a submission, but never decides it alone.
• Limits. One payout per person per job by default (one per milestone on a grant), and a daily cap on submissions from each wallet.
• The window. On public jobs, every approved payout waits 30 minutes and is checked again against everything that arrived since. A hit cancels it, with the reason.

A signal like a new wallet or a shared funder doesn't refuse anyone on its own. Together, signals can hold work for review. These defences were built against a real farm, where one person ran many wallets on a live job and was caught on chain.

How Sage refuses

The AI judge never refuses on its own. When it isn't sure, it holds the work for a person. Refusals come from rules, and each one Sage makes carries a written reason the person can read.

• At the door: a sanctioned wallet, a missing proof of personhood where one is asked, a second slot for the same person, a person already at their limit, too many submissions in a day, or someone who isn't on the job's invite list.
• After judging: the mission filled, or the person reached their limit. These reasons say plainly that they aren't a judgement on the work.
• In the window: a copy, a near-duplicate or a linked wallet found after approval cancels the payout, with the reason.
• When a job is stopped: its open submissions are closed, and the reason says so.

You can also approve or reject submissions by hand, from the job's page.

Feedback only after judging

Sage never scores work before it's submitted: no meter, no “you matched three of five” hint. A signal like that would let someone read the answers off the meter without doing the work. Feedback comes after a judged submission, and someone whose honest work fell short can revise it, up to 3 attempts.

Private payouts

An ordinary payout on chain writes a permanent public line: this address earned this much, on this day. For someone who lives on that income, being paid shouldn't publish it. On Starknet, Sage can pay privately.

1. The vault releases the reward, and Sage puts it straight into an escrow, not into the worker's wallet. The escrow holds it against a sealed code that names nobody.
2. The worker collects with a one-time claim link, to any Starknet address they choose. Sage sends the collection and pays its fee, so someone with no tokens, and no Starknet account set up, can still be paid.
3. A wallet registered with the STRK20 privacy pool can collect straight into a private balance instead, from the worker's own wallet.

On a vault created from Sage's current Starknet contract, this is what the chain shows:

Every figure Sage reports can still be checked on chain. Privacy removes the line back to a person, not the receipts. Two things to know. Sage keeps the claim link's secret so it can deliver the link to you, so the privacy is from the public, not from Sage. And older vaults, created before the current contract and still live, also name the worker in their payout and refusal records.

Compliance

Sanctions screening

Every Ethereum-style wallet is checked against the US Treasury's sanctions list (the OFAC SDN list of digital currency addresses) when it submits work, and again before Sage pays it automatically. A listed address is refused before its work is recorded. The list is a copy kept in Sage's code, not a live lookup: 120 addresses, as of 26 August 2026. Updating it is a reviewed change, never a silent download. Starknet addresses aren't on the list, so Starknet payouts aren't screened.

No identity checks

People are wallets, not names. Sage can ask for proof that someone is one person, never for a name or a document. If you need named recipients, use members-only work or an invite list, where you choose who can take part.

Who holds what

Your Sage account is a wallet held by Privy, a wallet provider, under spending rules that limit what Sage can do with it: launch your jobs, within your per-job cap. It's convenient and bounded, but it isn't self-custody. You can withdraw to any address at any time, and if you want sole control of your keys, sign in with your own wallet and fund jobs from it. People invited through Telegram are paid into a wallet Sage keeps for them, and can cash out from the chat to any address, with Sage paying the fee.

An audit trail by default

Every payout settles on chain with a public receipt, and lands on the person's record of verified work. Refusals are counted in public too. See receipts.

What this doesn't cover

• A founder who funds work on a product built to harm people is a policy problem, not a contract problem.
• Honest work that Sage can't verify gets refused. That is a real cost, and honest people bear it.
• These guarantees cover how money moves. They say nothing about whether a job was a good one to run. That call is still yours.