What AMW is
A warrant an owner signs and a contract enforces. It bounds what an autonomous agent may do with the owner’s money, not one action at a time, which every platform already does, but across a sequence, which none of them do.
Twenty-two pages, in six groups. Which one you want depends on what you came to do:
- Understand what it enforces Two tiers, every clause and its bound, the flag word, and the evidence each action leaves. Start at Two tiers; the rest is reference.
- Build an agent against it Two changes to an agent you already have, the mandate structure its owner signs, and the SDK that writes the typed data for you.
- Run it yourself Services, ports, database roles and recovery, and what a fully compromised agent key achieves against a deployment you control.
- Decide whether to believe it Somebody else’s scorer on four of their kits, the obligations these clauses trace to, and the limits, stated here before they are found.
Every page carries the next one at its foot, so any group also reads straight through. This page is the argument itself.
The problem it exists for
Nine swaps of 240,000 USDC under a 250,000 per-action cap. Every one satisfies the mandate. The aggregate reaches 2,160,000, and the ninth is held before it settles. Traditional finance criminalised that pattern as structuring fifty years ago; a per-action validator cannot see it by construction, because each action is fine.
That is the whole thesis: an unauthorised outcome, assembled entirely from authorised steps. An agent does not need to break a rule to reach a position its owner never sanctioned. It only needs to stay inside one, repeatedly.
Three properties everything else follows from
| Property | What it rules out |
|---|---|
| Enforcement lives in the contract, and nowhere else | No model, service or screen can permit what the guard refuses. Nothing above the contract is trusted, so nothing above it needs to be |
| The agent can ask and cannot spend | Zero balance, zero allowance, and the guard as sole approved spender. A stolen agent key moves nothing to itself, only within the mandate and back to the owner |
| A held action returns; it does not revert | A revert would roll back the events and leave the hold with no trace. Supervision that erases its own record is not supervision |
How the parts fit
Four layers, and the boundary between them is the product. Authority runs one way: down to the contract, never up from the agentic layer.
| Layer | Does | May not |
|---|---|---|
| Contracts | Evaluate every clause before settlement, hold what composes past a bound | Be upgraded: there is no proxy, no admin key, no pause authority |
| Evidence spine | Record what the chain said; anchor a commitment per intent | Be the authority. It is rebuildable from chain, and it is checked against the anchor |
| Supervisory crew | Investigate a hold and draft a case file whose every claim cites a record | Originate a finding, hold a key, or release anything |
| Console | Show exposure, the epoch, the case, and take a named human’s decision | Sign. The authoriser signs from their own key; the server files nothing the chain does not show |
What a firm actually changes
Two things. The owner approves the guard rather than the agent, and the agent
calls requestAction instead of calling the venue directly. Nothing else about how
the agent is built, hosted or scheduled changes: see
Integrate an agent.
Where to go next
Two tiers is the next page in order, and it is the one this argument runs into: what is bounded per action, and what is bounded across a sequence. If you would rather not read forward, the four routes at the top of this page each open their own group.