Constraints & the Trust Model
AERA's agent is autonomous, but autonomy is not the same as unlimited authority. Every action the agent can take is bounded by rules enforced in the smart contract itself — not by the agent's judgment, not by a policy document, and not by our word. This page explains exactly what those boundaries are, where they live, and how you can verify them yourself.
The core principle
Most "AI manages your money" products ask you to trust the model. AERA is built so that you don't have to — because the model isn't what stops it from doing something you didn't authorize. The contract is.
Concretely: the agent holds a restricted manager role on your vault. That role can only call one function — rebalance() — and that function is hard-gated by constraints written directly into the contract. If a proposed action falls outside those constraints, the transaction simply fails. It doesn't matter how the agent reasoned its way there.
What's actually enforced on-chain
| Constraint | What it does |
|---|---|
| Asset whitelist | The agent can only hold and trade assets you've explicitly allowed — a fixed list of Stock Tokens and approved yield positions. It cannot acquire anything outside that list, ever. |
| Max trade size | Each rebalance is capped as a percentage of total vault value. The agent cannot move your entire position in a single action, regardless of how confident its reasoning is. |
| Max slippage | Trades that would execute at worse than your allowed slippage tolerance are blocked before execution, not flagged after the fact. |
| Trade frequency limit | The agent can only act a bounded number of times per period. This prevents a malfunctioning or compromised agent from repeatedly draining value through excessive trading. |
| User-set risk parameters | Your sector limits, position size preferences, and risk tolerance are stored on-chain and checked against every proposed action. |
None of these are suggestions to the agent — they are checks the contract performs independently, before any trade is allowed to execute.
What you can always do, no matter what
- Withdraw your funds, at any time, without needing anyone's approval.
- Revoke the agent's permission entirely, instantly turning the vault back into a plain, unmanaged holding.
- Adjust your own rules — tighten limits, change sector allowances, or lower risk tolerance whenever you want.
These are user-only functions. The agent has no ability to block, delay, or override them.
The circuit breaker
Constraints catch anything that violates a hard rule. But some problems don't look like a rule violation — they look unusual. If the agent proposes an action that's technically within your limits but significantly out of pattern compared to its own history (an unusually large trade, an unusual frequency, a rarely-used asset), the system halts and flags it for manual review instead of executing automatically. This exists specifically to catch the failure modes that a fixed rule wouldn't — a corrupted data feed, an edge case in the model's reasoning, or unexpected market conditions.
Full decision transparency
Every proposal the agent makes — whether it executes, gets blocked by a constraint, or gets paused by the circuit breaker — is logged immutably, along with:
- The exact market and portfolio data the agent used to make the decision
- The plain-language reasoning behind it
- The outcome: executed, blocked, or held for review
This log is yours to inspect at any time. Nothing the agent does happens silently, and nothing is reconstructed after the fact — the log is written at the moment of the decision, not edited afterward.
Signing security
The agent's manager-role key is not a single hot wallet with unilateral authority. It's secured through multi-party signing infrastructure, meaning no single compromised key can move funds beyond what the contract already allows. Even in a worst-case key compromise, the blast radius is limited to the same constraints — whitelisted assets, max trade size, slippage limits — that apply to every legitimate action.
What this model does not claim
We want to be direct about the limits of this model, not just its strengths:
- It does not guarantee returns. Constraints govern how the agent can act, not whether its judgment about when to act will be profitable. Rebalancing well is still subject to market risk.
- It does not eliminate smart contract risk. Like any on-chain system, the vault contract itself is subject to audit findings and the general risks of smart contract security, even with no bugs found. We publish audit results and encourage you to review them independently.
- It does not replace your own judgment about whether AERA is right for you. The constraints protect you from the agent exceeding what you authorized — they don't substitute for deciding what you should authorize in the first place.
In short: you are not trusting an AI with your money. You are authorizing a specific, bounded, on-chain-enforced set of actions — and you can inspect, tighten, or revoke that authorization at any time. The agent's intelligence determines the quality of its decisions within those bounds. The contract determines the bounds themselves.