The agent decides on its own, but it never holds your money. This page explains what the architecture prevents from happening to it, even if the agent is wrong or compromised.
We never take custody of your money. At no point, in no phase of the product. Your capital lives in a Safe that belongs to you, and the agent joins as a member of a Zodiac role with permission for pool operations and nothing else. Withdrawing out of the Safe is not among them.
The part that matters: this is not a promise from us, it is a restriction enforced by the blockchain. If the agent's key were stolen, whoever held it still could not move funds out of your Safe, because the permission to do so does not exist.
Connecting your wallet only proves that it is you, through a SIWE signature. It does not authorise transactions and it does not grant access to funds. We never hold your private key, at any moment.
There is a switch that halts the agent completely, and it is fail-closed: when the system cannot read its own safety state, it stops instead of assuming everything is fine. Not acting is always the safer option when you manage someone else's capital.
The Sentinel runs separately and audits what the agent does, cycle after cycle. They are separate processes on purpose: a watchdog sharing the code of the thing it watches would be no watchdog at all.
The full internal audit of our security layers is not public, and we will not list here what is still open. This is not opacity for its own sake: a list of what is missing is a map for anyone looking for a way in.
No architecture removes the risk of providing liquidity. You remain exposed to impermanent loss, price moves, failures in the protocols where the liquidity sits, and mistakes by the agent itself within the limits it has. The detail is in the Terms.