Proof of Agent PoA
Launch app

In development on Solana devnet

Real Agents. Real Proof.

Proof of Agent lets an autonomous trading agent manage capital it can never take. The operator posts a bond that caps how much the agent may manage, and every trade is checked against the agent's mandate after it executes. If the agent breaks the mandate, it is paused, its size cap drops to zero, and its bond is slashed, with depositors credited first.

Launch app Read the eight records

Opens the app page. Nothing to connect, fund or sign yet.

Notice

Not live. No deposits, registrations or funds accepted. Anyone asking you to deposit in our name is not us.

A bot's promise needs a bond behind it

3 problems

Autonomous agents can trade around the clock with other people's money. Today, funding one means trusting the operator's word on custody, on risk limits and on what happens when things go wrong.

Problems today and the design answer
Item Problem today Design answer
A The key can move the moneyA bot that trades from an ordinary wallet can also withdraw from it. A plain wallet cannot separate trading from taking.

A key that can trade but never withdraw.

See record 04
B The rules are only wordsAllowed markets and leverage limits usually sit in a document. Nothing checks them trade by trade, and nothing happens when they are broken.

A mandate checked after every trade.

See record 05
C Nothing is at stakeWhen a bot breaks its rules, the people who funded it carry the loss. Often there is no collateral that answers for it.

A bond that is slashed, with depositors credited first.

See record 07
Total Proof of Agent answers all three.

From bond to enforcement, record by record

8 records

The design rests on one idea: the agent never holds the money it trades.

Every record below is a made-up example. The signatures are invented and shortened, and no value comes from Solana.

program: a Proof of Agent program transaction | keeper feed: an entry in the public pass-or-breach feed

  1. 01/08

    Record 1 of 8: Register

    IllustrativeResult: OK

    call register_agent | signer: operator | source: program

    Memo

    An operator registers an agent with a mandate: allowed markets, maximum leverage and a 24-hour drawdown limit.

    Fields
    agent
    Demo Agent
    operator
    OPR1...DEMO
    agent key
    AGNT...DEMO
    allowed markets
    SOL-PERP, BTC-PERP
    max leverage
    3x (demo, proposed)
    24h drawdown limit
    15% (demo, proposed)
    size cap
    0 USDT, no bond yet

    sig 3hQv...DEMO01 | 13:40:08 UTC | sample record, illustrative

  2. 02/08

    Record 2 of 8: Bond

    IllustrativeResult: OK

    calls lock_bond, init_venue_account, set_delegate | signer: operator | source: program

    Memo

    Then the operator locks a bond in USDT. No bond means no size. The bond sets the size cap, a fixed multiple of the bond. The operator then opens the agent's Velocity account, owned by the program, and makes the program's trader PDA, an address only the program can sign for, its delegate. The agent key gets no rights on Velocity.

    Fields
    bond locked
    1,000 USDT
    k
    5 (proposed)
    size cap
    5,000 USDT, 5x bond
    velocity account
    VELO...DEMO, owned by the program
    delegate
    TRDR...DEMO, the trader PDA, cannot withdraw or swap

    sig 9mTa...DEMO02 | 13:41:15 UTC | sample record, illustrative

  3. 03/08

    Record 3 of 8: Deposit

    IllustrativeResult: OK

    calls deposit 3 times, in 3 transactions | signers: depositors A and B | source: program

    Memo

    Depositors fund the agent up to that cap and get shares one for one. A deposit that would go over the cap is rejected on-chain.

    Fields

    depositor A
    2,000 USDT OK
    depositor B
    2,500 USDT OK
    depositor B
    1,000 USDT Reverted CapExceeded
    used
    4,500 of 5,000 USDT
    room left
    500 USDT
    cap check
    in deposit Enforced on-chain

    size cap 5,000 USDT | 1 cell = 500 USDT

    A 2,000 | B 2,500 | room left 500 | rejected 1,000

    Sample: 4,500 of a 5,000 USDT size cap used, 500 left, and a 1,000 USDT deposit rejected for exceeding the cap.

    last sig 6wLp...DEMO03, reverted | 13:44:30 UTC | sample record, illustrative

  4. 04/08

    Record 4 of 8: Trade

    IllustrativeResult: Pass

    call agent_place_perp_order, fill on Velocity, then keeper check | signer: agent key | source: keeper feed

    Memo

    The agent trades on Velocity through the Proof of Agent router. Its key signs orders to the router, which checks each one for theft protection only: perp markets only, a bounded price, a short order lifetime, size and turnover caps, and no builder fees. The router then passes the order to Velocity, signed by the program's trader PDA. The agent key can never withdraw. A keeper watches the agent's Velocity account and checks each trade against the mandate after it executes. Every result lands in the agent's public pass-or-breach feed.

    Fields
    router checks
    price, lifetime, size, turnover Pass
    position
    SOL-PERP long, about 2x
    market
    SOL-PERP allowed Pass
    leverage
    2.0x, max 3x Pass Keeper-attested
    drawdown 24h
    0.1%, max 15% Pass Keeper-attested
    equity
    4,496.20 USDT
    24h high-water mark
    4,500.00 USDT

    feed entry | fill sig 7hRk...DEMO04 | 14:03:12 UTC | sample record, illustrative

  5. 05/08

    Record 5 of 8: Breach

    IllustrativeResult: Breach

    call agent_place_perp_order, fill on Velocity, then keeper check | signer: agent key | source: keeper feed

    Memo

    The agent opens a small position on ETH-PERP, a market outside its mandate. The router lets the order through, because it checks theft protection, not the mandate. The keeper spots the position and records a breach.

    Fields

    position
    ETH-PERP long, small
    market
    ETH-PERP not allowed Breach
    leverage
    2.1x, max 3x Pass Keeper-attested
    drawdown 24h
    0.1%, max 15% Pass Keeper-attested
    open orders
    1, SOL-PERP limit
    status
    ACTIVE, until enforce
    next
    enforce

    feed entry | fill sig 2kPz...DEMO05 | no program transaction yet | 14:05:41 UTC | sample record, illustrative

    The post-trade gap

    Mandate checks run after a trade, not before. Losses can land before the pause. The bond is there to backstop that gap, and it may not cover all of it. If the keeper goes offline, breaches go unenforced until it returns.

  6. Pause, revoke and slash: one transaction

    06/08

    Record 6 of 8: Enforce

    IllustrativeResult: Paused

    call enforce | signer: keeper | source: program

    Memo

    The keeper calls enforce. The program reads the Velocity account itself, confirms the ETH-PERP position and pauses the agent. Its size cap drops to zero, the router refuses its orders, the trader PDA loses its delegate rights and the agent's open orders are cancelled.

    Fields
    rule
    market outside mandate
    position check
    read from the Velocity account Verified on-chain
    status
    ACTIVE to PAUSED
    size cap
    5,000 to 0 USDT
    agent key
    router refuses its orders
    delegate
    trader PDA revoked
    reduce-only
    on
    open orders
    1 to 0, cancelled*

    *If the open orders do not fit in one transaction, the keeper cancels them market by market in follow-up keeper transactions.

    sig 4xQm...DEMO06 | 14:05:44 UTC | sample record, illustrative

  7. 07/08

    Record 7 of 8: Slash

    IllustrativeResult: Slashed

    call enforce, same transaction as 06 | signer: keeper | source: program

    Memo

    The same transaction slashes the bond in full: 1,000 USDT is credited to depositors and none goes to the treasury.

    Listed one record at a time so you can follow it. On-chain, the pause, the delegate revoke and the slash land together in one enforcement transaction.

    Fields

    slash
    100% of bond, market rule (proposed)
    bond
    1,000 to 0 USDT
    to depositors
    1,000 USDT, into the capital vault
    to treasury
    0 USDT
    split
    fixed in code, depositors first Trustless
    status
    PAUSED to SLASHED

    sig 4xQm...DEMO06, same transaction as 06 | 14:05:44 UTC | sample record, illustrative

  8. 08/08

    Record 8 of 8: Unwind

    IllustrativeResult: Flattened

    calls close_positions twice, settle and unwind | signer: keeper | then claim | signers: depositors | source: program

    Memo

    The keeper closes both positions with reduce-only orders at a bounded price, settles their profit and loss, then withdraws everything back to the capital vault. The account is flat.

    Depositors can now claim, pro rata to the shares they hold, and each claim pays only the depositor's own wallet. There is no insurance. A slashed bond is a penalty paid to depositors, not coverage of their losses.

    Fields
    14:05:52
    close_positions SOL-PERP Closed
    14:05:58
    close_positions ETH-PERP Closed
    14:06:01
    settle SOL-PERP and ETH-PERP Settled
    14:06:05
    unwind: 4,508.90 USDT withdrawn, vault 5,508.90 Flattened
    14:06:30
    agent key order Refused by the router
    vault after unwind
    5,508.90 USDT, includes the 1,000 USDT slashed bond
    depositor A share
    2,000 of 4,500 shares, 44.4%
    depositor B share
    2,500 of 4,500 shares, 55.6%
    14:07:20
    claim, depositor A: 2,448.40 USDT, to A's own wallet
    formula
    share = vault after unwind x your shares / all shares

    claim sig 8nVc...DEMO08 | 14:07:20 UTC | sample record, illustrative

Who signs the records
Party Role Appears in
Operator Registers the agent and locks the bond. 01, 02
Depositors A and B Fund the agent up to its size cap, before its first trade, and get shares. They can withdraw at any time, or claim their share after an unwind. 03, 08
Agent key (Demo Agent) The trading bot's key. It only signs orders to the Proof of Agent router, which checks each one and passes it on. It has no rights on Velocity and can never withdraw. 04, 05
Keeper Checks each trade, triggers enforcement and pays withdrawals. Run by the team today. 04 to 08
Proof of Agent program Owns the agent's Velocity account, runs the order router and carries out the pause and the slash. every program record

Demo Agent is a sample. Every name and number in these records is illustrative.

Three layers: Verify, Monitor, Protect

The three layers and the records that show them
Layer Lead What it covers Records
Verify Every agent is on the record. Registration, mandate and bond are recorded on-chain. Each agent has a public profile and a pass-or-breach entry for every trade, with its transaction signatures.
Monitor Every trade is watched. A keeper indexes the agent's Velocity account: fills, positions, leverage, equity and 24-hour drawdown. The checks run automatically and unattended. Today the keeper is run by the team, as our known limits explain.
Protect A breach has a cost. A bond vault, a size cap and the order router come first: the router checks every order for theft protection before it reaches Velocity. On a breach, the keeper triggers enforcement: the agent is paused, the router refuses its orders, the delegate is revoked and its bond is slashed, depositors first. Then its positions are force-closed. Every step is a public transaction anyone can check.

In the small marks beside each record, the top node is Verify, the left is Monitor and the right is Protect.

Schedule A | Demo parameters, proposed
Parameter Demo value
Size cap5x the bond (k = 5)
Allowed marketsSOL-PERP, BTC-PERP
Max leverage3x
24-hour drawdown limit15%
Slash on a breach100% market rule, 100% leverage rule, 50% drawdown rule

Each operator sets its agent's mandate: the three rules and a slash ratio for each. The registry sets k for new agents. These are the proposed defaults for the devnet demo agent. They are not final and may change before launch.

The agent can trade the capital. It can never take it.

spec sections 3 and 4, in brief

The agent's Velocity account is owned by the Proof of Agent program, not by the operator and not by the agent. The agent key has no rights on Velocity. It can only sign orders to the program's router, which checks each one and passes it on through the program's trader PDA, the account's delegate. A leaked agent key could trade the account badly, inside the router's limits, but it could not withdraw from it.

OwnerProof of Agent programOnly it can withdraw, change the delegate or change settings.

ownsowns

CapitalThe agent's Velocity accountDeposits land here, up to the size cap.

tradesis traded by

SignerAgent keySends orders through the router.

watchesis watched by

WatcherKeeperChecks each trade and triggers enforcement.

Agent key permissions
Action Agent key
The agent key can
Place orders, through the routerYes
Cancel orders, through the routerYes
The agent key cannot
WithdrawNo
BorrowNo
Swap tokens outNo
Change the delegateNo
Change account settingsNo
Close the accountNo
Custody as designed for the MVP on Velocity. The agent key has no rights on Velocity: the delegate is the program's trader PDA, which cannot swap, and every order limit is checked in Proof of Agent's code.
Trust model in brief
Component In the MVP Relies on How
Trustless or verified on-chain
Custody Trustless for withdrawals The program The account's owner is a program address. Only the program's code decides withdrawals. The venue delegate is the program's trader PDA, never the agent key, and it cannot swap.
Order router Trustless in code The program, with limits the admin sets within bounds fixed in code Every agent order is checked before it reaches Velocity: perp markets only, a price close to the oracle, a short lifetime, size and hourly turnover caps, and no builder fees. The router checks theft protection only, not the mandate.
Size cap Enforced on-chain The program, in deposit Checked inside the deposit instruction. A deposit over the cap fails. This bounds the capital Proof of Agent accepts; on devnet anyone can deposit straight into the Velocity account, and the keeper nets such deposits out of equity.
Market rule Verified on-chain The program reads the Velocity account Before it acts, the program reads the Velocity account and confirms the position is on a market outside the mandate. A false report fails.
Slash split Trustless Fixed in code Depositors are credited first, and only the rest goes to the treasury.
Keeper-attested, permissioned or trusted today
Leverage Keeper-attested The keeper's numbers The keeper computes leverage with Velocity's own math and oracle prices. The program checks the numbers against the mandate but trusts that they are honest.
Drawdown Keeper-attested The keeper's equity samples The keeper samples equity every 60 seconds and posts checkpoints on-chain. The program computes the 24-hour high-water mark from them but trusts the samples.
Enforcement trigger Permissioned The keeper key, held by the team Only the registered keeper key can trigger enforcement. This is the one central point of the MVP.
Withdrawal price Keeper-attested The keeper's equity checkpoint A withdrawal is paid at the equity of a keeper checkpoint written in the same transaction. The program trusts that value, and pays only the investor's own wallet. A stolen keeper key that also held shares could overprice its own withdrawal.
Venue Trusted Velocity's team Velocity is run by its own team, who can upgrade their program and pause markets. Its oracle prices are posted by Velocity.

Limits we publish

  1. The keeper key is held by the team. It is the one central point of the MVP, and a malicious keeper could pause and slash an honest agent.
  2. If the keeper goes offline, breaches go unenforced until it returns.
  3. Mandate checks run after a trade, not before. Losses can land before the pause. The bond is there to backstop that gap, and it may not cover all of it.
  4. The admin can rotate the keeper key, set k for new agents, pause new registrations, set the router limits, the minimum deposit and the withdrawal and shutdown timers within bounds fixed in code, withdraw from the treasury and pause the router. The admin cannot touch bonds, capital or Velocity accounts.
  5. Inside the router's limits, a dishonest agent can still trade badly on purpose, including against an account it controls. The drawdown rule and the bond backstop that loss, not the router.

Read the known limits

The full trust model, published as written in our amended spec.

One set of rules for both sides

operators | depositors

Operators get a way to prove they stand behind their agent. Depositors get rules they can read before they fund, and a bond that pays them first if those rules are broken. None of this is open yet: Proof of Agent is in development on Solana devnet and accepts no deposits.

For operators

Put up a bond. Get capacity and a record.

Your bond shows you stand behind your agent. It sets how much capital the agent may manage, and every trade adds to a public record anyone can check.

  • Capacity grows with your bond: the size cap is a fixed multiple of what you lock.
  • A public profile shows your mandate, your bond and every pass or breach.
  • Your agent trades freely inside its mandate. The router only refuses orders that fail its theft checks, nothing is blocked on mandate grounds, and every trade is checked against the mandate after.
  • Your bond stays locked while your agent manages capital. You can retire your agent at any time, and you get the full bond back once it is unwound if no rule was broken.

Note

Break the mandate and your bond is slashed.

For depositors

Fund agents that have something to lose.

Before you fund an agent, you can read its mandate, its bond and its record. If it breaks the mandate, its bond is slashed and credited to depositors first.

  • Size is capped: an agent can never take in more deposits than its size cap, and you see the room left before you sign. Deposits close at the agent's first trade.
  • The mandate is frozen while capital is deposited, so the rules cannot change under you.
  • On a breach, the slashed bond goes to depositors before anyone else.
  • You hold shares and can ask for your money back at any time. The keeper pays at the agent's value in its checkpoint, and if a request waits 24 hours, anyone can wind the agent down. After an unwind, you claim your share pro rata by shares, including any slashed bond, paid to your own wallet.

Note

Losses are possible. Mandate checks run after each trade, so a loss can land before a pause, and the bond may not cover it. Nothing here promises a return.

09 Milestone Pending

call enforce | network: Solana devnet | source: program, once it exists

The first proof will be a breach

Our first milestone, to be recorded in one take: a demo agent breaks its mandate once, on purpose. In one enforcement transaction, the agent is paused and its bond is slashed on-chain, so its public profile goes from ACTIVE to SLASHED. Anyone can open that transaction in Solana Explorer.

Notice

Not live. Proof of Agent is in development on Solana devnet and does not accept deposits, registrations or funds. Anyone asking you to deposit in our name is not us.

Launch app Get notified at launch

Write to hello@proofofagent.rocks and we will get back to you once there is something to show.

sig: not yet recorded