What AMW is
A warrant an owner signs and a contract enforces. It bounds what an autonomous agent may do with the owner's money — not one action at a time, which every platform already does, but across a sequence, which none of them do.
The problem it exists for
Nine swaps of 240,000 USDC under a 250,000 per-action cap. Every one satisfies the mandate. The aggregate reaches 2,160,000, and the ninth is held before it settles. Traditional finance criminalised that pattern as structuring fifty years ago; a per-action validator cannot see it by construction, because each action is fine.
That is the whole thesis: an unauthorised outcome, assembled entirely from authorised steps. An agent does not need to break a rule to reach a position its owner never sanctioned. It only needs to stay inside one, repeatedly.
Three properties everything else follows from
| Property | What it rules out |
|---|---|
| Enforcement lives in the contract, and nowhere else | No model, service or screen can permit what the guard refuses. Nothing above the contract is trusted, so nothing above it needs to be |
| The agent can ask and cannot spend | Zero balance, zero allowance, and the guard as sole approved spender. A stolen agent key moves nothing to itself, only within the mandate and back to the owner |
| A held action returns; it does not revert | A revert would roll back the events and leave the hold with no trace. Supervision that erases its own record is not supervision |
How the parts fit
Four layers, and the boundary between them is the product. Authority runs one way — down to the contract, never up from the agentic layer.
| Layer | Does | May not |
|---|---|---|
| Contracts | Evaluate every clause before settlement, hold what composes past a bound | Be upgraded — there is no proxy, no admin key, no pause authority |
| Evidence spine | Record what the chain said; anchor a commitment per intent | Be the authority. It is rebuildable from chain, and it is checked against the anchor |
| Supervisory crew | Investigate a hold and draft a case file whose every claim cites a record | Originate a finding, hold a key, or release anything |
| Console | Show exposure, the epoch, the case, and take a named human's decision | Sign. The authoriser signs from their own key; the server files nothing the chain does not show |
What a firm actually changes
Two things. The owner approves the guard rather than the agent, and the agent
calls requestAction instead of calling the venue directly. Nothing else about how
the agent is built, hosted or scheduled changes — see
Integrate an agent.
Where to go next
- Two tiers — what is bounded per action, and what is bounded across a sequence.
- Preview before signing — ask the contract what a mandate would permit, with no wallet and no gas.
- The evidence spine — what is published, what stays in custody, and how to verify a disclosed record.
- Security model — what a fully compromised agent key achieves.