The agent decides on its own, but it never holds your money. This page explains what the architecture prevents from happening to it, even if the agent is wrong or compromised.
We never take custody of your money. At no point, in no phase of the product. Your capital lives in a Safe that belongs to you, and the agent joins as a member of a Zodiac role. That role covers pool operations, staking, coverage and stablecoin conversion. The full list is on the screen where you sign it. Withdrawing out of the Safe is not among them, and that is the one that matters.
The part that matters: this is not a promise from us, it is a restriction enforced by the blockchain. If the agent's key were stolen, whoever held it still could not move funds out of your Safe, because the permission to do so does not exist.
Our fee comes only out of the fees your position generates, never out of the capital. And when the agent collects them, they do not pass through your Safe. They go straight to a contract that splits them on the spot, your share to your Safe and ours to ours.
The part that matters: nothing leaves your vault. Our share is what never enters it. The split is engraved in that contract, which has no owner: at most 10% for us, and not even we can change that. Changing it would take a new contract and your signature.
And you do not depend on us to receive. Triggering the split is public: anyone can do it, and the outcome is always the same.
Connecting only proves that it is you, through a SIWE signature that authorises nothing. After that your wallet is asked for exactly two things, both of them explicit and both of them yours to refuse: one signature that grants the permissions above, and one transfer that moves your capital into your own vault.
Everything the agent does afterwards it signs with its own key, never with yours. Your private key never leaves you, at any moment, and no signature we ask for can move funds out of your Safe . That permission does not exist to be granted.
There is a switch that halts the agent completely, and it is fail-closed: when the system cannot read its own safety state, it stops instead of assuming everything is fine. Not acting is always the safer option when you manage someone else's capital.
The Sentinel runs separately and audits what the agent does, cycle after cycle. They are separate processes on purpose: a watchdog sharing the code of the thing it watches would be no watchdog at all.
A claim that the agent cannot withdraw funds is worth nothing unless someone has tried. On every change to the code, a suite of tests runs against a copy of the real chain and attempts the attacks an intruder would attempt: sending collected funds to an outside address, minting a position to somebody else, approving a different spender, transferring the position away, and several more.
Every one of them is expected to be rejected by the on-chain permissions, and the test fails if any succeeds. This is the part that matters: the protection is not our code being careful, it is the chain refusing. Our code could be entirely compromised and those transactions would still revert.
If you find a weakness, write to security@architecthq.xyz. Tell us what you found and how to reproduce it, and please give us a chance to fix it before publishing. We do not run a paid bounty programme yet and will not pretend otherwise, but reports are read by a human and taken seriously.
The full internal audit of our security layers is not public, and we will not list here what is still open. This is not opacity for its own sake: a list of what is missing is a map for anyone looking for a way in.
No architecture removes the risk of providing liquidity. You remain exposed to impermanent loss, price moves, failures in the protocols where the liquidity sits, and mistakes by the agent itself within the limits it has. We describe these plainly on the risks page, and the legal detail is in the Terms.