Bonded capital for autonomous agents
The accountability layer
for autonomous trading
Every agent action is checked against an immutable mandate before any funds move. When an agent breaks that mandate, its own staked capital pays the depositors it put at risk — automatically, in the same transaction.
- Capital bonded by agents
- —tUSDG
- Paid to depositors
- —tUSDG
- Violations blocked
- —
01How it works
Blocking a trade costs an agent nothing. Paying for it does.
Policy engines stop bad actions and stop there. The agent has no reason to improve, and the one time your rules have a gap you absorb the loss alone.
Prevent
Every action is an EIP-712 signed intent, checked against an immutable mandate before any funds move. The vault makes no arbitrary calls — it approves an exact amount to an allowlisted venue and nothing else.
Prove
A rule-breaking intent never executes. Its signature is still cryptographic evidence that this key authorised this trade in breach of this mandate — and it stays valid whether or not the trade ever reached the chain.
Pay
That evidence slashes the agent’s bond to depositors in the same transaction. The bond is posted in the asset you deposited, so a payout needs no pricing, no oracle and no claims committee.
02Lifecycle
Follow one intent to every possible ending
Most agent-safety projects stop at “blocked”. That is the point where this one starts working.
- 01
Bond posted
The operator stakes the agent’s own capital. The vault will not accept deposits until it does.
- 02
Agent proposes
An LLM reads prices, news and the mandate, then suggests one trade and explains why. It never signs.
- 03
Code signs
Deterministic code converts to raw units, signs an EIP-712 intent and commits a hash of the reasoning.
- 04
Rulebook runs
14 checks in a fixed order, on-chain. It always returns a verdict — it never just reverts.
The rulebook returns one of three verdicts
Exact approval
only to an allowlisted venue
Trade fills
NAV and positions update
Approval reset
back to zero, same tx
The vault never makes an arbitrary call — only typed calls to venues named in its mandate, for the exact amount.
Blocked
nothing executes
Strike recorded
not misconduct — state moved
Three strikes
cool-off that clears itself
The agent could not have known the price would move. Bad luck is not misconduct, so it is never slashed.
Blocked
nothing executes
Signature kept
published as public evidence
Anyone reports
court re-checks on-chain
Bond slashed
90% depositors · 10% reporter
The agent could have checked this rule before signing, so signing is the offence. A second breach freezes the vault and unwinds it to cash.
Separately — an honest agent caught by the market
Floor crossed
NAV/share below high-water − 8%
Breaker trips
anyone can call it
Unwound
everything sold back to cash
Gap paid
bond lifts NAV/share to the floor
Paid against realised cash after the unwind, not a paper loss — the test suite checks NAV per share lands exactly on the floor.
Every step after signing is permissionless: the relay, the watcher bot or any wallet can submit, report, trip the breaker, unwind and settle. There is no admin key that can freeze funds, forgive a slash or move depositor money. Penalty size, bounty share and the floor are set per vault in its mandate; the split shown is the demo mandate’s.
03Difference
Not another guardrail
A guardrail limits what an agent can do. Velanos makes the agent answerable, with its own money, for what it tries to do.
| When | Typical agent guardrail | Velanos |
|---|---|---|
| The agent tries a forbidden trade | Blocked. Nothing else happens. | Blocked — and its signature on that trade slashes its own bond to depositors. |
| Whose money is at risk first | Depositors’, entirely. | The agent’s. It posts a bond before a single deposit is accepted. |
| An honest mistake — a limit hit because prices moved | Treated the same as misconduct, or not distinguished at all. | Rejected with no penalty. Misconduct and bad luck are separate rule bands. |
| The market falls past what depositors were promised | Depositors absorb it. | Trading halts and the bond tops depositors back up to the floor — exactly. |
| Who enforces the rules | The operator’s own server. | Anyone. Every enforcement call is permissionless and reporting pays a bounty. |
| What counts as proof | Logs on the operator’s machine. | Signed intents and on-chain events that anyone can re-verify. |
| The agent stops responding at the end of its term | Funds sit in open positions until someone intervenes. | Anyone can force settlement, and a late penalty comes out of the bond. |
04Live vaults
Capital under mandate
Each vault pairs one agent with one immutable set of rules and one bond. Open any of them to see every intent the agent has signed.
No vaults indexed yet
Run pnpm demo:seed to register an agent and create the demo vaults.
06Scope
What the bond answers for
And what it does not. Payouts are capped at the size of the bond, and the fund screen names the unbacked remainder before anyone deposits.
Covered
- Trades outside the mandate
- Oversized or over-leveraged orders
- Acting after a freeze or after expiry
- Losses beyond the drawdown floor, up to bond size
- Failure to settle when the term ends
Not covered
- Losses within the agreed drawdown limit
- Strategy underperformance
Ordinary market risk inside the mandate stays with depositors. That is the deal, and stating it plainly is what makes the rest of the promise worth anything.