How Mandate
keeps your agent in line.
Mandate is a module for your smart wallet. You set the rules once and sign them. Your AI agent can then trade only through Mandate, which checks every trade before and after it runs and undoes anything outside your rules.
Basics01–04
01What Mandate does
The rules live in a contract, not in the agent's prompt. So they hold even if the agent's key is stolen, or someone talks the agent into something in a chat.
- Your money can't leave your wallet. No transfers to anyone, and no trades that pay out to someone else.
- The agent can't change the rules, your keys or your wallet's settings.
- Losses per trade are capped, against your whole portfolio and against the trade itself.
- Losses per 24 hours are capped. Hitting the cap stops the agent.
- A falling market slows the agent down: first it may only sell, then it stops.
- No open-ended approvals. The agent can only let a protocol take exactly what a trade needs.
- No price, no trade. If the price feed is stale or the network is unhealthy, the agent waits.
02How a trade is checked
- The agent sends a trade to Mandate, never to your wallet directly. It has no other way in.
- Before: Mandate checks who is asking, whether the agent is active, and every call in the trade against the safety floor and your list of allowed actions.
- Mandate notes your portfolio and reads prices from oracles, once.
- The trade runs.
- After: Mandate values the portfolio again at the same prices. The difference is exactly what this trade cost you, whatever the market did. Your rules are checked against it.
- Anything outside the rules is undone as if it never happened, and the reason is recorded. Repeated attempts count as violations and can freeze the agent.
Your own actions as the owner don't go through Mandate. You can always move, withdraw or trade your money yourself.
03Who can do what
| Who | Can | Can't |
|---|---|---|
| You, the owner | Everything: set and change rules, choose or revoke the agent, unfreeze it | — |
| The agent | Trade within your rules until its access expires | Move money out, change rules, unfreeze itself |
| A guardian (optional) | Freeze the agent or switch it to sell only, e.g. a monitoring service | Loosen anything or touch the money |
| Anyone | Ask Mandate to revalue your portfolio at current prices | Make your status softer |
Agent access always has an end date (30 days in the playground). You can renew or revoke it at any time.
04Try it
The playground runs on Base Sepolia, a test network. Nothing there is real money.
- Connect a wallet: MetaMask or Phantom (turn on testnet mode). We send a little test ETH for fees.
- Pick rules: a template, or your own.
- Sign once. You get a smart account with $10,000 in test USDC, your rules and an agent.
- Try to break it. Give the agent normal tasks, scam messages and risky trades, and watch which rule stops what. The market moves on its own and sometimes crashes.
Specification v0.205–13
05Safety floor
Always on, in every policy. No setting can turn these off.
| # | The agent can never |
|---|---|
| F1–F2 | Call your wallet or Mandate itself, so it can't change settings, keys or rules |
| F3 | Send ETH to a plain address |
| F4 | Run code in your wallet's name (delegatecall) |
| F5 | Transfer tokens or NFTs, or sign permits that let someone else take them |
| F6 | Approve a spender you didn't allow, or approve more than a trade uses |
| F7 | Pack more than 8 calls into one trade |
| F8 | Send a call without a function name |
With the floor alone and no other rules, the agent can trade any size and can lose money on bad trades, but it still can't move money out.
06What the agent may call
- Only actions on your list. Each one is a specific protocol and function, for example “swap on Uniswap”. Anything else is refused.
- The payout goes to you. For each allowed action you can pin who receives the result. In the playground a swap must pay out to your account, so a swap “to my friend's address” is refused.
- Exact approvals. The agent may approve only spenders you allowed, only on tokens Mandate tracks, and the approval must be fully used in the same trade. Nothing is left open afterwards.
- A spending cap on ETH sent with each allowed call, if you set one.
07How the portfolio is valued
- You choose which tokens count (up to 16), each with a USD price feed. Stablecoins are marked as base assets.
- A token not on the list is worth $0. Buying a scam token looks like losing the money, so the loss rules catch it.
- Prices come only from oracles (Chainlink), never from a trading pool that someone could push for a moment.
- Stale price or unhealthy network ⇒ no trading. Mandate also checks Base's sequencer and waits an hour after it comes back.
- Debt counts as negative when lending positions are supported.
| Term | Means |
|---|---|
| Portfolio value | Everything tracked, minus debt |
| Trade loss | Portfolio value before minus after, at the same prices |
| Trade size | How much value moved between assets |
| Share | One asset's part of the portfolio |
| Peak | The highest portfolio value Mandate has seen |
08Rules you can set
Every rule is optional; leave it empty or at 0 and it's off. A policy can be one rule or none. Rules are checked after the trade runs, in the order below.
| # | Rule | Stops | When hit |
|---|---|---|---|
| P1 | Loss per trade, % of portfolio and/or $ cap | One trade losing more than this | undone |
| P11 | Slippage, % of the trade | Sandwich attacks and bad routes, even on small trades | undone |
| P4 | Loss in 24 hours, % of portfolio | Many small losses adding up | frozen |
| P2 | Trade size, $ | One trade moving too much | undone |
| P3 | Turnover in 24 hours, $ | Trading too much in a day | undone |
| P12 | Can buy, per asset | Buying an asset you only want sold | undone |
| P5 | Any one asset, % (and per asset) | Putting too much into one asset | undone |
| P6 | Leverage, × | Borrowing beyond this | undone |
| — | Drawdown → sell only, % | Buying more after the portfolio fell this far from its peak | sell only |
| — | Drawdown → freeze, % | Any trading after a deeper fall | frozen |
| — | Trades per hour | A runaway loop | refused |
| — | Violations in an hour → freeze | An agent that keeps trying | frozen |
| — | Freeze at once on an attempt to move funds out | A hijacked agent, on its first try | frozen |
Details that matter
- Prices are fixed during the check, so the market moving at the same moment never makes a good trade look bad, or the other way round.
- 24 hours means the last 24 hours, not a calendar day. The budget can't be spent at 23:59 and again at 00:01.
- Reducing risk is always allowed. If an asset grew past its share because its price went up, the agent can still sell it. Share, leverage and sell-only rules trip only when a trade makes things worse.
- One big loss is undone; many small ones freeze. A single trade over the per-trade limit is undone. Losses that each passed it but add up past the 24-hour budget freeze the agent.
09Templates
The playground starts from one of three. You can change any number afterwards.
| Rule | Floor only | Careful | Active trading |
|---|---|---|---|
| Loss per trade | — | 0.5% | 1%, max $150 |
| Slippage | — | 0.5% | 1% |
| Trade size | — | $1,000 | $3,000 |
| Turnover in 24h | — | — | $20,000 |
| Loss in 24h | — | 2% | 3% |
| Any one asset | — | 20% | 20%; WETH 30%, cbBTC 40% |
| Leverage | — | — | 1.5× |
| Drawdown → sell only / freeze | — | 5% / 10% | 8% / 15% |
| Trades per hour | — | 10 | 20 |
| Violations → freeze | — | 3 | 3 |
| Instant freeze on theft attempt | — | on | on |
10Status: active, sell only, frozen
| Status | The agent can | Gets there by |
|---|---|---|
| Active | Trade within the rules | Default; only you can bring it back |
| Sell only | Only reduce risk: sell assets, repay debt | Drawdown past the soft limit, or the guardian |
| Frozen | Nothing | Deep drawdown, 24h loss limit, too many violations, a theft attempt (if on), portfolio worth $0, the guardian or you |
- Only you can unfreeze or lift sell-only. Nothing unfreezes on its own, not even the next day.
- Drawdown follows the market, not just trades: it's measured from the peak at current prices. A sleeping agent should still be stopped when the market crashes, so anyone may ask Mandate to revalue your portfolio. The playground does this when a crash hits an asset you hold. Revaluing can only make the status stricter.
- After you withdraw money yourself, the drop looks like a drawdown and may freeze the agent. That's the safe direction. Reset the baseline to the current value afterwards.
11Violations and instant freeze
Every undone trade that broke a rule counts as a violation. When violations within the window (an hour in the playground) reach your limit, the agent is frozen. An agent talked into something in a chat usually tries several times; this stops it after a few.
Some attempts are never an honest mistake: paying a stranger, a token transfer, approving an unknown spender, leaving an approval open. With instant freeze on, the first one freezes the agent.
These don't count as violations: a stale price, a rate limit, or the protocol itself rejecting the trade (for example Uniswap's own slippage check).
12What it protects against
| If… | Mandate | Worst case |
|---|---|---|
| The agent's key is stolen | Floor, allowed actions, loss limits, freeze | Bad trades within your 24h loss budget |
| The agent is tricked in a chat | Same, plus violations freeze it | Same |
| A trade pays out to a stranger | Refused: payout must go to you | Nothing lost |
| The agent buys a scam token | Counted as $0, so loss limits stop it | Nothing beyond your loss limit |
| Someone asks for an unlimited approval | Only exact approvals | Nothing lost |
| A price is manipulated for a moment | Oracle prices only | Nothing lost |
| The oracle or network fails | Trading stops | The agent waits |
| A bot sandwiches a swap | Slippage and loss limits | Up to your per-trade limit |
| An allowed protocol turns malicious | Loss limits on the result | Up to your 24h loss budget |
| The guardian is compromised | A guardian can only freeze | The agent stops |
| The Mandate team is compromised | No admin key, no upgrades | Nothing |
13What it doesn't cover
- Good trading. The agent can still lose money within your limits. Set them to what you're willing to lose.
- Your own key. If the owner key is stolen, the thief is the owner.
- Tokens you didn't add. Mandate doesn't watch them.
- Not yet: a waiting period before loosened rules take effect, a health-factor rule for lending, perps and LP positions, several agents per wallet.
Mandate is a prototype and hasn't been audited. Use the playground; don't use it with real funds.