Pre-execution firewall for AI agents: called before any onchain action, it decodes the calldata and returns allow or deny plus a signed, verifiable receipt. Blocks drainers like unlimited approvals.