01 Mandate
What the agent may touch, how much per day, which hours, when it expires, what kills it. Written once, encrypted, held by you. Nobody else can read it — not us, not the agent.
Arcveil · Arc (chain 5042)Agents that can spend. Never see. Never exceed.
Hand an agent a mandate instead of your keys. It works in relative terms, never sees your balances, and every action it takes leaves a receipt you can check.
✓ receipt v1 · five checks · nothing leaves your tabBuilt for
Arc, by CircleCircle L1, EVMUSDC is the gas
02 Veil
The agent asks in relative terms — move 30% of the position in A — and the enclave turns that into real amounts. Balances, positions and totals never reach the model.
03 Receipt
Every settled action emits a proof that the mandate was respected. Verifiable by anyone, readable by no one, and chained so a missing receipt shows up as a gap.
The choice
Ladder. Three ways to let a machine spend your money.
01 Give it your key
The agent holds the private key. This is what most agent stacks do today, because it is the only thing that works out of the box.
- One jailbreak is total loss
- The key is copied wherever the agent runs
- No limit exists that the agent cannot lift
02 Give it an allowance
A session key or spending cap on a smart account. A real improvement: the loss is bounded by the cap.
- The permission is a blob — it cannot say when, or why, or how much of your book
- Every amount is public on chain
- The agent still sees your entire balance
This product
03 Give it a mandate
An encrypted policy the agent cannot read and cannot reach around. Limits are enforced where the agent has no access, the agent works in relative terms, and every settled action emits a receipt.
- The agent never receives an absolute number
- Limits are enforced outside the agent's reach
- Each action leaves a receipt anyone can verify and nobody can read
Costs you: a co-signer in the path today. See “If we disappear” below.
Architecture
Pipeline. Six steps, and the agent never sees a number.
- 01
Intent
Agent
The agent proposes in relative terms: reduce exposure to A by 30%. It never states an amount, because it was never told one.
Artifactintent{ asset, ratio } - 02
Redact
Enclave
The enclave resolves the ratio against balances the agent cannot see and builds the unsigned operation.
ArtifactuserOp (unsigned) - 03
Client sign
Your device (Shard A)
Your device decrypts its shard from the OS keystore and signs the operation hash.
ArtifactsigA (65 bytes) - 04
Mandate check
Policy co-signer (Shard B)
Every clause of the mandate is evaluated — allowlist, per-action cap, window spend, active hours, kill switch — and only then is the second signature produced.
ArtifactsigB (65 bytes) - 05
Settle
Arc (chain 5042)
The two signatures combine into a 130-byte threshold payload; the account contract validates the quorum and executes.
ArtifactsigA ‖ sigB (130 B) - 06
Receipt
Issued to you
The body is hashed, the policy signer attests it, and the budget commitment advances — so a dropped receipt later shows up as a gap.
Artifactreceipt v1 (~1 KB)
Steps 1, 2 and 4 are designed, not shipped. Step 6 is — the format is documented and the verifier below runs on it.
Who sees what
Threat model. Privacy from whom, exactly.
Row three is the one that deserves suspicion. We hold a co-signer, so we can refuse to sign — we cannot sign alone, cannot move funds, and cannot read the mandate we check against. What happens when we refuse, or vanish, is the ‘If we disappear’ section below.
Proof, not adjectives
Receipts. Check one right now. Nothing leaves this tab.
Everything above describes a machine that is still being built. This part is not a description: load a sample, edit a character of it, and watch the checks disagree with you. The settlement check is a live read of Arc mainnet; the two that need our contracts say unknown until those contracts exist.
FIG.1
Reads Arc 5042
FIG.2
Load a sample or paste a receipt. Five checks run here, in your browser — the only request made is a read of Arc itself.
Illustrative — worked example on testnet parameters, not production telemetry.
Worked example
One action. What each party learned, and what it cost.
01 What the agent saw
An instruction in ratios: reduce exposure to A by 30%. A pass verdict. No balance, no total, no price.
02 What the chain saw
One operation from a smart account, validated by a 2-of-3 quorum. No asset name, no amount attached to your identity.
03 What you saw
A receipt in your feed: swap, 02:14, mandate respected, five checks green — and the numbers, because they are yours.
- Receipt size
- ~1.1 KB
- Proof size, attestation
- 64-byte signature
- Proof size, zk (planned)
- ~128–256 B
- Checks run
- 5 of 5
- Verified in
- in-browser, no backend
Failure modes
If we disappear. The part most products leave out.
01 Mandates expire on their own
A mandate carries its own expiry. Stopping an agent never requires us to be reachable — doing nothing stops it.
02 Two of three, without us
Your device shard and your passkey recovery form a quorum on their own. Your funds do not need our signature to move.
03 Receipts outlive the service
The verifier is client-side and the format is documented. Receipts you already hold stay checkable with no server, ours or anyone's.
What actually happens while our co-signer is down: your agent cannot act. That is the failure we chose — an agent that stops is recoverable, an agent that keeps spending is not.
Verify a receiptDesigned, not shipped — the escape hatch contract lands with the mandate contracts.
Where this is
Roadmap. With the labels the right way round.
shipped
01 Receipt format v1 and verifier
The artifact and the way to check it, before anything that produces it.
- canonical hashing
- attested proof
- in-browser checks
- budget chain
in progress
02 Mandate contracts and SDK
Registering a mandate, anchoring budget commitments, and a typed client for both.
- mandate registry
- anchors
- TypeScript SDK
- testnet
next
03 Desktop app
Threshold signing across device, co-signer and passkey, in an app you install.
- 2-of-3 signing
- OS keystore
- passkey recovery
- escape hatch
planned
04 Veiled execution
Relative intents resolved inside the enclave, so the model never receives an absolute number.
- relative intents
- enclave resolve
- clearance levels
planned
05 Zero-knowledge policy proofs
The attestation is replaced by a proof; the receipt format does not change.
- policy circuit
- same format
- no trusted signer
planned
06 Receiver unlinkability
Stealth destinations so the chain observer loses the last thread it had.
- stealth addresses
- unlinkability
Nothing above is written in the present tense until it ships. If a claim and a status chip disagree, the chip is right.
Protocol
Specifications. What it runs on, and what is not built yet.
| Execution network | Arc mainnet, chain ID 5042planned |
|---|---|
| Chain reader | Live — the verifier reads Arc mainnet over JSON-RPC, from your browsershipped |
| Mandate registry | Not deployed; the two checks that need it report unknownplanned |
| Development network | Arc testnet, chain ID 5042002planned |
| Native gas | ETHplanned |
| Account | ERC-4337 smart accountplanned |
| Signing | 2-of-3 ECDSA: device shard, policy co-signer, passkey recoveryplanned |
| Receipt format | v1 — docs/RECEIPT.mdshipped |
| Proof today | Enclave attestation, ECDSA P-256shipped |
| Proof next | Zero-knowledge policy proof, same receipt formatplanned |
| Verifier | Runs client-side, no backend, no request leaves the tabshipped |
| SDK | TypeScript, viem-basedin progress |
FAQ
Questions. The ones a sceptic asks first.
What is a mandate?
An encrypted policy you write once: which assets an agent may touch, how much per action and per window, which hours, when it expires, and what stops it. It is enforced where the agent cannot reach, and nobody but you can read its terms.
Can you read my mandate?
No. We check a commitment to it and evaluate clauses; the terms themselves stay sealed. What we can do is refuse to co-sign. What we cannot do is sign alone, move funds, or see what you hold.
What happens if the agent is jailbroken?
It asks for something outside the mandate, and the second signature never appears. A jailbroken agent under a mandate can waste its own time; it cannot exceed a limit it was never able to see or reach.
Is this custody?
No. Signing authority is split three ways and we hold one share. Your device and your passkey recovery form a quorum without us.
Which network and assets?
Arc — Circle’s EVM layer 1 for stablecoin finance, where USDC is the gas token. We target mainnet, chain ID 5042, and the verifier already reads it: paste a receipt and the settlement check queries Arc directly from your browser. Our own contracts are not deployed yet, so the two checks that depend on them answer unknown rather than guessing.
What does a receipt actually prove?
That an authorised agent session produced this action, that every mandate clause was checked and passed, and that it settled in a sequence with nothing removed. It does not prove the decision was a good one — a receipt bounds behaviour, not judgement.
When do zero-knowledge proofs land?
After the mandate contracts and the desktop app. Receipts issued today stay valid when it happens: only the proof field changes.