Solutions / Agentic Finance
Agents on POY rails can invest within constraints you set. Clients keep custody throughout.
The problem
Payments are the one job where the blast radius is bounded by the amount. Anything past it means trusting an agent's judgement with no mechanism behind the trust.
An agent that can allocate can also allocate wrongly, and no operator signs off on a capability whose worst case is unlimited.
Instructions constraining an agent sit in the layer an attacker is working to compromise. A control belongs somewhere the attacker cannot reach.
The available answer has been to take the keys away, which removes the agent's usefulness along with its risk.
The security argument
Every other defence tries to stop an attacker reaching the agent, which means winning every time while the attacker needs to win once. This one concedes the whole attack and still holds.
01
The agent reads a poisoned input
Assume the injection works. Assume it works perfectly.
02
It is convinced to act against you
Assume the reasoning is fully captured by the attacker.
03
It signs and submits a transaction
Assume the keys behave exactly as designed, because they will.
04
The contract checks the proof
There is no proof that the committed mandate produced this action, because it did not.
05
The transaction reverts
It never settles, so there is nothing to flag for review or reverse afterwards.
A policy engine defends by catching the bad instruction. POY never has to catch it, because a compromised prompt still cannot produce an action the mandate would have authorised.
What POY enforces
The client sets the bounds. The agent reasons freely inside them. The onchain product decides what settles, and it is not persuadable.
Eligible venues, position types, counterparties and size are compiled into the program the account proves against before any action executes.
The mandate bounds what the agent can do. Inside those bounds its judgement is still its own, and a proof says nothing about how good that judgement is.
Exposure ceilings, leverage bounds and rate limits hold per action, so a runaway loop hits a wall rather than a monitoring alert.
Limits are checked at settlement, on what the account executes. What the agent contemplates is unbounded, and so is what the market does next.
A compromised agent produces transactions that do not verify, so the attack terminates at settlement rather than at the model.
This comes from where enforcement sits rather than from detection. POY never identifies a malicious instruction. It makes one unable to settle.
Who this is for
Custodians, treasury teams and agent platforms who want the capability without an unbounded worst case, and whose clients will not hand over keys to get it.
How it works today
Agents are scoped to payments and stay there
Constraints live in the prompt an attacker is targeting
Safety means removing the agent's ability to act
The worst case is bounded only by what you funded
With POY
Agents allocate inside a mandate the product enforces
Constraints live in the circuit, below the reasoning layer
The custodian's MPC keys keep signing exactly as they do now
The worst case is whatever the mandate allows
Agents that allocate, bounded by the product instead of a promise.