Swap on Uniswap. Stake on Lido. Supply on Aave. One treasury decision, three different apps, and from a Safe, often a separate round of signatures for each.
Two things should be true here. The person managing the position shouldn’t need control over the whole treasury to do the job. And once the move is agreed, they shouldn’t have to chase signers through every step of it.
Zodiac Pilot is how we handle both. Its browser extension lets you record a workflow in the DeFi apps you already use, simulate every transaction, and request any permission you’re missing along the way. Each app responds to the simulated results of your earlier steps, and when the whole thing is ready, it goes out as one atomic transaction.
Your Safe, inside the apps you already use
Once your Zodiac account is set up, open Pilot and pick the account you want to connect to a dapp. Then use the app the way you normally would. Pilot records the underlying contract calls in its side panel as you go.
This is the point of the extension: your Safe and its permissions show up where the work actually happens. A treasury workflow can span several protocols, each with its own interface, and Pilot strings the supported flows together into one sequence you can inspect and execute.
Your team keeps the interfaces it knows, and your assets stay in your Safe until you execute.
A shopping cart that the apps can see
Say Ana needs to swap USDC for ETH, stake and wrap the ETH into wstETH, then supply it to Aave, all on Ethereum.
She starts on Uniswap. Pilot records the swap and simulates it on a fork, a working copy of the chain. Her session now shows the result: less USDC, more ETH.
When she opens Lido, it sees that simulated ETH balance, so she can build the next step on top of it. After the stake and wrap, she opens Aave, and the wstETH is there, ready to supply.
The interfaces react to each new transaction as if it has already happened. The real funds have not moved.
That’s the shopping cart. Every action goes into the batch along with the token approvals it needs, and each one starts from where the last one left off. Ana can line up a whole chain of dependent steps without committing to any of them.
Only the permissions the work needs
Ana doesn’t need the keys to the treasury. She needs to swap, stake, and supply through specific contracts, with the resulting assets and positions staying with the treasury. That’s least privilege: enough authority for the job, and no more.
A policy can pin that down tightly: which functions she can call, with which parameters, down to recipients and amounts. It has to cover the token approvals too. The owners stay in control of what’s in the policy, and the Roles contract enforces it onchain.
Once the policy is in place, routine work gets fast. Ana can repeat permitted actions without collecting a fresh round of owner signatures each time, and if she’s authorized to execute the batch directly, one signature submits the whole workflow.
Request permission as you record
Sooner or later, the next task needs something Ana’s policy doesn’t cover yet.
When that happens, she records the action anyway and uses Request permission in Pilot. The recorded call becomes a proposed addition to her policy. She can attach it to an existing recorded action or create a new one.
The request comes straight from the work she’s trying to do: this contract, this function, these inputs. Her team reviews the actual calls and sets the constraints the job needs, at the moment the need comes up.
Nothing changes onchain until the authorized signers approve and apply the policy update. Recording and simulating an action doesn’t give Ana permission to execute it.
Check every step. Commit once.
Before signing, Ana reviews the whole batch: the calls, their simulated effects, and the permission checks for her role. If something fails or a permission is missing, she fixes it, then refreshes the simulation against current chain state.
Once it all checks out, she submits the batch as one atomic transaction. If the Aave supply fails, the swap and the stake roll back with it. The treasury never ends up halfway.
One caveat worth knowing: the simulation is a snapshot. Prices and liquidity can move before you sign, so your slippage and transaction limits still matter, and a reverted transaction can still cost gas.
Scope your next workflow with Zodiac
If there’s a workflow your team runs every week and dreads a little, bring that one. In a 30-minute call, we’ll map its steps, work out the permissions it needs, and go through the account setup to run it with Pilot.