An agent rebalances a vault at 3 a.m. and pays 4% slippage on a thin pool.
Nobody approved that trade. Nobody can say why it picked that route.
That's the failure to design against, and it isn't a model problem.
This guide explains what an agent is, where it fits in DeFi, and how to bound it.
Save the agent spec template in section 3 for your next build.
What an AI Agent Is, and How It Differs From a Bot
An AI agent is a program that uses a language model to pick its next step. It reads state, decides which tool to call, calls it, and loops until the goal is met or it hands back.
A trading bot runs fixed rules. If price crosses a line, it sells. It does the same thing every time, which is why you can test it fully.
The difference matters most when something new happens:
- A bot follows its rules into the new situation. It might lose money, but you can predict how.
- An agent reasons about the new situation. It might handle it well, or it might take an action nobody planned for.
So an agent buys you flexibility and costs you predictability. In DeFi, where actions move money and can't be undone, that trade needs a design around it.
What the agent touches
On Solana, an agent's tools are usually wrappers around program calls: swap, deposit, withdraw, stake, transfer. Open-source kits such as Solana Agent Kit package those calls as tools for frameworks like LangChain and the Vercel AI SDK.
The kit gives the agent hands. It doesn't decide which hands it should have. That part is your job, and it's where most of the engineering goes.
The 3 Places Agents Touch DeFi
Agents show up in three layers of a DeFi product. Each one carries a different level of risk.
Execution
The agent signs transactions that move funds. Think rebalancing a vault, routing a swap, or rolling a position before expiry.
This is the riskiest layer. A wrong call costs money right away and can't be reversed. If an agent works here, it needs hard limits that live outside the model.
Risk
The agent watches positions and flags trouble. It reads health factors, oracle prices, and pool depth, then writes a summary or opens a ticket.
Here the agent advises and a person or a fixed rule acts. A bad call means a noisy alert, not a lost position. This is where to start.
Operations
The agent handles the work around the protocol. It drafts incident reports, answers support questions about a transaction, reconciles treasury records, or prepares a governance summary.
Nothing here signs a transaction. The risk is a wrong answer, which a person can catch in review. Our Hermes write-up shows this pattern for sales and marketing work, with people kept on the judgment calls.
Start at operations or risk. Move into execution only when you have the boundary below in place.
How to Bound a DeFi Agent
Our AI agent development work follows one rule: one workflow, one agent, with a boundary, a log, and an off switch. For a DeFi agent, write that boundary down before any code.
Use this spec template. Fill each field before the build starts.
# agent-spec.yaml
workflow: vault-rebalance
owner: ops-lead@yourprotocol.xyz # the human who owns this workflow
trigger: cron every 15m, or health factor < 1.3
reads:
- vault state account
- oracle price for each asset
- pool depth on approved DEXs
tools:
- swap (approved pools only)
- deposit / withdraw (vault program only)
limits:
max_trade_usd: 5000
max_slippage_bps: 50
max_daily_volume_usd: 25000
irreversible_actions:
- any swap or withdraw # gated by limits above
takeover_point: any limit hit, any unknown pool, or two failed runs in a row
kill_switch: revoke agent token delegate; pause flag on vault program
cases: evals/vault-rebalance/*.json # acceptable, incorrect, unsafe, ambiguousThe numbers are placeholders. Your limits come from your vault size and your risk appetite.
The named boundary
The boundary is three lists: what triggers the agent, what it may read, and which tools it may call. Anything off those lists is out of scope. Irreversible actions are listed and gated, not discovered in production.
The human takeover point
Every workflow names a person who owns it. The spec also names the exact moment the agent stops and hands back. A limit hit, an unknown pool, or repeated failure all mean the agent stops and a person decides.
The Kill Switch and Re-Runnable Cases
A kill switch only works if it lives outside the agent. Don't rely on the model obeying a "stop" message.
Put the limit on-chain
On Solana, a simple pattern is a token delegate.
The SPL Token program lets an owner approve a delegate to move up to a set amount. The owner can revoke that delegate at any time.
Give the agent's key a delegate allowance, not ownership of the vault. The allowance caps what it can ever move. Revoking it is your kill switch, and it works even if the agent's server is compromised.
For larger systems, add a pause flag to your own program. The agent can't clear it, and only a multisig can. Now you have two independent ways to stop it.
Test with saved cases
Before every change, rerun the agent against saved cases. Sort them into four groups:
- Acceptable cases the agent must handle correctly.
- Incorrect cases where the right answer is to do nothing.
- Unsafe cases that must trigger the takeover point.
- Ambiguous cases where the agent should abstain and ask.
Each group gets a pass threshold. Also set limits on latency and cost per run. If a new model or prompt drops below them, it doesn't ship.
When you run more than one agent, you need one place to see them all. Mission Control is our open-source, self-hosted control plane for that.
It dispatches tasks, lets you inspect runs, tracks spend, and records approvals. The code is MIT licensed on GitHub.
When Not to Use an Agent in DeFi
An agent is the wrong tool more often than the hype suggests. Here's when to skip one:
- The rule fits in an if statement. Liquidate below a health factor, rebalance at a set drift. A bot is cheaper, faster, and fully testable.
- Speed is the edge. Arbitrage and liquidation races are won in milliseconds. A model call adds seconds of latency and loses the race.
- You can't name the owner. If no person will own the workflow and answer for it, nobody will catch the agent's mistakes.
- You have no saved cases. Without examples of right, wrong, and unsafe behavior, you can't tell if a change made things worse.
- The downside is uncapped. If you can't put a hard limit on what the agent can move, keep it in advisory mode.
Fixed pricing rules belong in a program. The Pump Science case study is a historical example: each longevity compound got its own token on a bonding curve, with dynamic fees and automated liquidity migration to a DEX. A curve like that is a rule, not a judgment call.
A good first step is a bot for the clear rules, plus an agent that drafts reports for people. You learn where judgment helps before you hand over a key.
FAQ
What is an AI agent in DeFi?
An AI agent in DeFi is a program that uses a language model to read on-chain state, decide on an action, and call tools such as swaps or deposits. Unlike a bot, it chooses its own steps. That makes it flexible, and it needs hard limits around it.
Is an AI agent safer than a trading bot?
No, it's usually less predictable. A bot does the same thing every time, so you can test it fully. An agent can take a step nobody planned for, which is why it needs a boundary, a takeover point, and a kill switch outside the model.
Should an AI agent hold my private key?
No. Give it a key with limited power, such as a token delegate with a capped allowance. Keep ownership and upgrade authority with a person or a multisig, and make sure you can revoke the agent's access in one step.
Where should I start with AI agents in DeFi?
Start in operations or risk, where the agent advises and a person acts. Collect the cases where its advice was right and wrong. Move into execution only once you have limits on-chain and a tested kill switch.
Build an Agent You Can Switch Off
An agent in DeFi is only as safe as the boundary around it. Name the workflow, name the owner, cap what it can move, and test it before every change.
If you want help scoping one, our Architecture Sprint runs $3K to $5K and includes acceptance criteria and a build plan. For the on-chain side, our Solana DeFi development team builds the limits and pause logic. Tell us about the workflow, and try the spec template on it first.
