Give autonomous agents bounded authority.
Not unrestricted wallets.
AI agents can now execute multi-step workflows, call financial tools, and move liquidity autonomously — yet capital infrastructure still treats them like human users clicking MetaMask. With autonomous software, a single prompt injection, poisoned context, or runaway tool loop drains flat wallets instantly. Mandant provides the missing financial control layer: recursive budgets that delegate downward, ERC-8183 escrow that settles on verified delivery, and 1-transaction containment that halts rogue workers without stopping the swarm.
Observe Bounded Agent Authority in Action
The three foundational primitives deployed on BNB Smart Chain Testnet: Vault sub-delegation, ERC-8183 escrow settlement, and 1-Tx containment with sibling immunity.
Every existing solution was built
for a human with a wallet.
Not a swarm with a hierarchy.
Today, quant desks and agent builders face a difficult trade-off: give an autonomous agent a powerful wallet and trust the software to behave, or maintain isolated keys with manual overhead. Neither scales across swarms. Gnosis Safe, session keys, and agent-commerce protocols each leave critical gaps when authority flows downward through autonomous layers.
A financial constitution
for your entire swarm.
Mandant changes the paradigm from “give an AI a wallet and trust it” to “give an AI bounded authority, verify what it spends money on, and contain it when something goes wrong.” Built around three mathematical primitives:
Hierarchical Budget Delegation
Instead of giving every agent access to the same wallet, Mandant creates a hierarchy of bounded mandates. A treasury allocates budget to an orchestrator, which delegates strictly smaller micro-budgets to child workers. Authority only moves downward and becomes strictly more constrained. Mandant enforces a balance conservation invariant at every block: idle capital, child delegations, and locked job funds must reconcile with the original grant.
Idle_P + ΣChildGranted_i + LockedInJobs_P = GrantedBudget_PConservation enforced at EVM bytecode level — money cannot be minted, duplicated, or leaked.Outcome-Verified Escrow (ERC-8183)
Instead of transferring funds upfront, payments lock into an ERC-8183 escrow tied to a specific job and deliverable hash. An evaluator contract verifies the submission before funds release. Invalid results or expired jobs auto-refund upstream.
1-Tx Subtree Containment
When an agent hallucinates or acts outside its mandate, a 1-transaction kill switch revokes the affected subtree, recovers unspent funds to the parent, and leaves independent sibling workflows executing without downtime.
Sibling Fault Isolation
Containment is surgical, not systemic. Revoking a compromised agent has zero effect on independent sibling branches. Other operations continue without interruption, manual intervention, or contact with the primary treasury.
Active risk enforcement.
Before the breach costs you.
With autonomous software, normal AI failures become financial failures. Center Guard converts organizational risk policies into onchain bytecode constraints, monitors swarm execution velocity, and executes automated circuit breakers before prompt-injected or runaway tools leak treasury capital.
Immutable Policy Commitments
Every agent's permissions are committed onchain as a deterministic policy hash at mandate creation. Center Guard enforces this at the bytecode level — any attempt to call an unlisted contract or API triggers an immediate EVM revert before value moves.
Agent Identity & Behavioural Credit Score
Every mandate node carries an ERC-8004 decentralised identity (DID). Center Guard computes a continuous credit score from invariant compliance, job delivery rate, and anomaly history — giving operators a live, verifiable risk profile for every agent in the swarm.
$0-Grant Sentinels. Always Watching.
Watchdog nodes carry zero spending authority — they exist only to observe. When a sentinel detects runaway tool loops, anomalous dispatch patterns, or prompt-injection signatures, it triggers a 1-transaction containment with cryptographic proof and no human in the approval loop.
From treasury to leaf worker —
every agent knows its boundary.
Authority flows exactly one direction: down. Each layer can only ever be a strict subset of its parent — smaller budget, narrower permissions, shorter expiry. There is no architectural path for capital to flow upward, sideways, or outside its mandate.
The Capital Source
The human treasury or DAO depositor sets the absolute ceiling. Budget, permitted vendor allowlist, and expiry are established here and inherited by every agent in the hierarchy — without exception and without the possibility of override.
The Delegator
Orchestrators carve bounded sub-budgets from their own reserve and delegate them downward. The moment a child grant is created, the parent's idle balance decrements by exactly that amount. No double-spending is architecturally possible.
The Executor
Worker agents fund ERC-8183 jobs from their bounded grant. Capital moves into escrow — not directly to the vendor. It settles only when the evaluator confirms the deliverable. Failed work returns the funds upstream automatically.
The Verifier
An onchain evaluator confirms the deliverable hash and SLA terms before any settlement executes. Pass — vendor receives payment. Fail or expire — the escrow refunds upstream. No human arbitration. No disputed invoices.
Lock. Delegate. Verify. Settle.
No step is skippable.
Lock
A treasury or DAO operator deposits USDC and creates a root mandate: the budget ceiling, a permitted vendor allowlist, and an expiry date. These parameters are immutable — no downstream agent can modify them.
Delegate
Orchestrators create attenuated sub-budgets for every agent beneath them. Each delegation instantly decrements the parent's idle reserve. No agent can be granted more than its parent currently holds.
Execute
Worker agents fund jobs into ERC-8183 escrow vaults, each tied to an expected deliverable hash and SLA. Capital is locked, not transferred. It will not move until the evaluator verifies the result.
Settle
Verified delivery → vendor receives payment. Anomaly detected → 1-transaction revoke, capital sweeps home. Every outcome is deterministic. No human decision required.
Built to sit underneath
your agent stack. Not replace it.
We deliberately built Mandant as EVM-native infrastructure that sits underneath existing agent orchestration systems rather than asking teams to replace how their agents already work. Keep your model logic, tool-dispatch pipelines, and frameworks across LangChain, ElizaOS, and AutoGen. Mandant adds the missing financial control layer: recursive budget delegation, outcome-based escrow, and 1-transaction subtree recovery.
Integrate in minutes
Delegate a bounded sub-budget from any parent mandate. TypeScript and Python SDKs.
spawnChild({
budgetUSDC: 200,
allowlist: [gateway]
})
Full REST, WebSocket, and RPC event stream. Monitor mandate state, settlement events, and sentinel alerts in real time.
Provable compliance.
Every state transition on record.
Every state transition in the mandate hierarchy — every delegation, every escrow, every revocation — commits a cryptographic leaf to an epoch Merkle tree. Risk committees don't receive a dashboard. They receive math: a tamper-evident proof that no agent ever exceeded its authority.
One-Click Audit Export
Download a complete cryptographic proof pack: every node state, every settlement receipt, every invariant verification. Self-contained and verifiable offline.
Stateless Verification
Any third party can call isMandateIntact(rootId) to independently verify that no agent exceeded its authority — no trusted intermediary required.
Merkle Integrity Log
Every transition is committed to an append-only epoch Merkle tree. Tampering with any historical record invalidates the root hash.
From setup to production mandate.
Four steps.
Real mandates.
Real capital constraints.
Every entry in this feed represents a live mandate operation — a delegation created, an escrow settled on verified delivery, or a containment event isolating an anomalous agent. No transaction can exceed the budget it was granted.
Priced to the capital
you put in motion.
Transaction volume generates protocol settlement fees, while dedicated policy controls and watchdog sentinels provide recurring enterprise software governance.
For teams building and stress-testing autonomous agent workflows
- Unrestricted sandbox mandate depth
- N-level delegation hierarchy
- Full SDK — TypeScript & Python
- Interactive protocol simulator
- Cryptographic audit receipts
Per ERC-8183 payment verified and settled through Mandant
- Audited production mandate vaults
- Outcome-verified escrow settlement
- 1-transaction subtree circuit breaker
- 100% sibling fault isolation
- Cryptographic Integrity Pack
- Sub-second event stream
Enterprise governance for quant funds, foundations, and DAO treasuries
- Dedicated high-throughput sentinel RPC
- Custom evaluator contracts — zkTLS / TEE
- Enterprise Policy Studio with custom threat models
- Cross-chain revocation relay
- Risk committee onboarding and SLA coverage
Put capital into autonomous software.
With mathematical certainty.
Mandant is in private evaluation with select quant desks, agent infrastructure teams, and DAO treasuries. Sandbox access, architecture briefings, and production integration support are provisioned on a reviewed basis.