Autonomy in execution. Bounds enforced by the chain. The smart account refuses anything outside your agent’s mandate — no judge, no allowlist server, no new chain to migrate to.
Models hallucinate. Prompt injection works. Counterparties feed adversarial data. The bound has to live somewhere the agent can’t reason around — and that means on the chain.
A compromised agent server is one prompt injection away. The allowlist runs on the same machine being attacked.
A second model is still a model. It hallucinates approvals, gets tricked by adversarial framing, and adds latency at the most expensive step.
A vendor policy engine you don't control is a single trust anchor. If the agent sees the API, the agent can probe through it.
Scope the action surface: targets, function selectors, parameter ranges, caps. The TypeScript SDK is ABI-typed against the contracts you permission — your IDE autocompletes the agent’s mandate.
// the trader can swap stables only
allowSwap({
sell: [USDC, USDT, PYUSD],
buy: [USDC, USDT, PYUSD],
sellAllowance: '100k-monthly',
})Your model reasons, plans, and decides. It signs with the agent’s key and submits — no off-chain coordinator, no verifier, no judge in the hot path.
// the agent decides and submits
const tx = await agent.propose(prompt)
await role.execute(tx)Deterministic, and checked onchain. If the model is jailbroken and tries to drain to an attacker address, the smart account rejects in place. No alert, no human in the loop, no inference cost.
// the chain decides
✓ swap USDC → DAI within cap
✗ transfer 100k USDC to 0xbad…
reverted: out of scopeTune what the agent can attempt independently of how the agent thinks. Ship more autonomy where the chain says it’s safe; tighten the bound where you’re not yet sure.
The role is the contract. Out-of-scope calls revert at the chain — not at your server, not at a vendor’s endpoint. No probing surface.
Each agent gets its own Safe with its own role. One strategy going off the rails cannot reach another strategy’s funds.
The Smart Execution Router dry-runs multi-step bundles against current chain state. Bad outcomes caught before they cost gas.
Permission checks are deterministic and enforced onchain. No inference, no judge, no LLM hallucinating an approval.
No new chain to bridge into. No new MPC escrow to onboard. The agent runs on your existing Safe, on the chain you already trust.
Every action is attributable to a role onchain. Per-strategy logs, per-agent attribution, every revert recorded. Forensics is straightforward.
Multi-strategy agents operating institutional capital. Each strategy bounded, each role isolated.
Embedding agentic surfaces into your protocol without inheriting agent risk on the protocol treasury.
Shipping autonomous DeFi products without a vendor in your runtime trust path.
Adopting agent-driven rebalancing and yield routing under hard onchain caps.
Proven in production
Built on Safe. Designed for real-world onchain operations.