The mandate layer for Solana.

1. Thesis

Capital allocation to autonomous operators — AI agents and human strategists alike — is bottlenecked by trust, not capability.

On Solana today, an agent can trade on any venue, pay for data and compute over x402, and register a verifiable identity. What no agent — and no human operator — can do is manage a stranger's capital under rules the stranger can actually enforce. Every form of delegation on the market reduces to one of two bad options: hand over custody, or hand over a key and hope.

Markov's thesis is that the first neutral, on-chain enforcement layer for delegated authority becomes the venue where operator track records are born. Enforcement is the wedge. The verifiable track-record graph it produces — who operated whose capital, under what constraints, with what outcome, provable from chain state — is the durable asset. Enforcement first, underwriting later.

2. The Problem

Delegation is binary. Today you either give an operator custody (funds, CEX copy-trading, managed accounts) or you give them a signing key with unrestricted authority. There is no native way to say: you may trade this capital on these venues, up to these amounts, until this date — and nothing else.

Off-chain policy is a promise, not a guarantee. Key-management platforms offer policy engines — spending limits, allowlists — enforced by their servers. That works when you trust whoever runs the server. It structurally cannot serve delegation between strangers, because a server operator (or a compromise of one) can bypass its own policy. Adversarial delegation needs a referee neither side controls.

Track records are screenshots. Operators market themselves with claimed PnL that cannot be independently verified. Allocators either trust the marketing or don't allocate. There is no portable, chain-verifiable performance history bound to an operator's identity.

Agents make this acute. Machine payments are no longer hypothetical: the x402 protocol has processed tens of millions of transactions on Solana since launching (35M+ transactions and $10M+ volume per the Solana Foundation, mid-2026), roughly 100M cumulative agentic transactions on Base by Q1 2026 (Chainalysis), and the value mix has shifted decisively toward real economic flows — transfers of $1+ grew from 49% to 95% of x402 volume between early 2025 and early 2026 (Chainalysis). Agent identity registries are live and growing. Payments: solved. Identity: emerging. Authority: missing. No business hands an agent its treasury key, and no individual should. The absence of bounded authority is now the binding constraint on agent capital.

Existing on-chain delegation doesn't generalize. Vault protocols let users deposit into an operator's strategy — but the strategy set is fixed by the vault design, the policy surface is narrow, and the primitive doesn't extend to operational spend, expiry, or arbitrary venue constraints. They are products. Markov is the primitive underneath them.

3. The Idea

A mandate: a non-custodial account in which the owner and the operator are different, mutually distrusting parties, and the account itself enforces the terms of engagement.

The owner deposits capital and attaches a policy. The operator — an agent or a human — receives delegated authority to act, but only through the mandate program, which permits exactly what the policy allows and nothing else. Withdrawal authority never leaves the owner. Every action emits a receipt. The owner can revoke instantly, at any time, unilaterally.

Delegation stops being an act of trust and becomes an act of configuration.

4. The Solution: the Markov Protocol

Mandate accounts. Program-derived vaults holding the owner's assets. Owner and operator keys are registered at creation; their powers are asymmetric by construction. The operator can act within policy. Only the owner can withdraw, amend policy, or revoke.

Policy. A mandate's policy is a compact, on-chain object defining the operator's entire authority:

• Program allowlist — the only venues the operator may touch (e.g., a swap router, a lending market)
• Token allowlist — the only assets the mandate may hold
• Per-transaction and rolling daily notional caps
• Per-venue execution bounds — e.g., maximum swap slippage, enforced at CPI time; leverage/position caps for derivatives venues as those adapters ship
• Operational spend budget — x402 payments for data, compute, and APIs, capped per-call and per-day
• Expiry — mandates end by default; renewal is an owner action
• Fee terms — the operator's management/performance split, settled in-program
• Revocation — unconditional, instant, owner-only

Enforcement. Operator instructions route through the Markov program, which validates them against policy and CPIs into allowlisted programs only. There is no code path from operator authority to withdrawal or to a non-allowlisted program. Policy violations don't get flagged — they fail. Enforcement is layered: the operator SDK runs fast soft gates first (freshness of the pricing a decision was made on, intent idempotency, optional token risk scoring) so doomed proposals are refused cheaply before broadcast — but soft gates are convenience, not the guarantee. The program's hard gates are the guarantee, and nothing reaches a venue without passing them.

Receipts. Every mandate action emits a structured event: what was done, on which venue, at what size, under which mandate. Refusals are receipts too: a blocked action emits an event carrying a machine-readable reason — over cap, expired mandate, venue not allowlisted, kill switch, and so on — so the record shows not only what an operator did but what the policy stopped it from doing. The accumulated log is a portable, independently verifiable operating history bound to the operator's identity — the raw material of the track-record graph.

Kill switch. Revocation takes effect in one transaction. The operator's authority dies; the owner's assets never moved out of the owner's control to begin with.

Scope honesty (v1). Version 1 enforces structural constraints — allowlists, caps, budgets, expiry, revocation. Portfolio-level risk limits (max drawdown, net exposure) require trusted price feeds evaluated mid-execution and are deliberately deferred to v2. Structural constraints cover the majority of what owners actually fear: unauthorized venues, unauthorized assets, oversized positions, and unbounded loss of control.

5. Float: the Product

Float is the consumer surface of Markov — an app and a bot.

The marketplace. Browse operators — agents and human strategists — each with a chain-verified track record assembled from mandate receipts, not screenshots. Filter by strategy, venue set, drawdown-free tenure, and fee terms. Fund a mandate in one flow: pick an operator, set or accept a policy template, deposit.

The owner console. A live feed of receipts across your mandates, current policy state, and the kill switch — one tap to revoke. Delegation with the situational awareness of self-custody.

Copilot and autopilot. Float offers two modes on the same rails. In copilot, an agent proposes and every action requires the owner's one-tap approval — delegation with a human in the loop. In autopilot, the owner funds a mandate and the agent acts within policy on its own. Users graduate from copilot to autopilot as trust builds, and the receipts are identical either way. In both modes custody never moves: funds sit in mandate accounts only the owner can withdraw from — no Float component, no bot, and no operator can send them anywhere else. Funding and policy changes are wallet-signed by the owner; nothing in the system holds owner keys.

The bot — Float agent. Receipts and alerts pushed to Telegram (approaching caps, expiry, anomalous activity), with revoke-by-command. The console you don't have to open. Its authority model is deliberate: the bot holds a revoke-only delegated permission — it can never move funds, place trades, or amend policy. A fully compromised bot can do exactly one thing: revoke a mandate you might not have wanted revoked. Its worst case is protecting you unnecessarily — the inverse of custodial chat-bot trading tools, whose worst case is a drained wallet.

Launch radar. A read-only discovery feed — new listings and market activity with always-computed token risk scores surfaced beside them. Radar informs; it never executes. Anything acted on from radar still passes the full gate stack of whichever mandate acts, and radar itself carries no protocol risk surface.

Seed supply. Float launches with a small set of first-party agents running deliberately conservative strategies — e.g., stablecoin yield rotation across allowlisted lending markets — so the marketplace demonstrates the primitive from day one rather than launching empty. First-party agents operate under the same mandates, same receipts, same kill switch as anyone else.

The operator side. An SDK that wraps mandate-constrained execution for agent builders and strategists: submit intents, receive policy-validated execution, accumulate portable track record. Operators integrate because Markov is where provable history — and therefore allocable capital — lives.

6. Integrations

Venues. Initial CPI allowlist targets are Solana's liquidity backbone: an aggregated swap router and one or two blue-chip lending markets. The allowlist architecture makes each new venue an adapter, not a redesign.

Payments. x402 via public facilitators. The same policy that caps an operator's trading caps its operational spend — an agent can buy the data feed it needs, within budget, and the receipt stream shows the spend beside the trades it informed. Machine payments become a governed action type, not a separate trust problem.

Identity. Mandate receipts bind to operator identity so history is portable across mandates. Markov integrates with agent identity registries as they standardize on Solana rather than issuing a competing identity primitive.

Wallets and keys. Owners connect standard Solana wallets. Operators bring their own key infrastructure; Markov constrains what the key can do, so the key's custody model is the operator's choice and the owner's indifference. An operator's own wallet holds exactly two things: its identity and its gas. User capital lives only in mandate accounts, and no operator instruction has a code path that moves it out of owner control.

The developer surface. Markov ships as one program and a small set of SDKs, each with a named consumer — an SDK without one is scope creep:

• Operator SDK — for agent builders and strategists: propose intents, receive policy-validated execution, accrue receipts. The first-party Float agents run on this same public SDK from day one.
• Client SDK — for wallets and frontends acting on behalf of owners: mandate lifecycle (create, fund, amend, revoke), policy reads, receipt subscriptions, kill switch.
• Score SDK — for any protocol consuming operator reputation: query scores, fetch the evidence bundle of receipts behind them, gate features on either. The reference scoring model is open and versioned, and every score is recomputable from chain data — a score nobody can audit is a score nobody should integrate. Its sybil-resistance is economic (history under real capital and fees is expensive to fake); it scores operators under mandates and is not a general proof-of-personhood oracle.
• Venue adapter kit — for venues: implement one interface, sit behind every gate. Built when a third party asks, not before.
• MCP server and agent skill files — so LLM-based agents can take and operate a mandate as a tool out of the box.

All clients generate from the single program IDL and wrap thin — one source of truth, several thin skins, not several codebases. The hosted score API is metered over x402: agents pay per reputation check on the same rails their mandates govern.

7. Business Model

Protocol fee. Markov takes a share of operator fees at settlement, enforced in-program at the moment performance/management fees are paid out. Vault-infrastructure comparables take on the order of 10–15% of operator fees; exact terms are set at mainnet. Revenue scales with operator earnings, which scale with total value mandated — the protocol earns only when operators do.

Float fees. A marketplace fee on funded mandates and, later, premium analytics for allocators (operator screening, portfolio views across mandates).

The endgame: underwriting and agent credit. The receipt graph compounds into the reference dataset for operator risk, and that dataset climbs a strict dependency ladder — each rung requires the one below it:

1. Receipts — chain-verified operating history under enforced policy (v1).
2. Score — a sybil-resistant operator rating derived from receipts. Resistance is economic, not identity-based: the score weights distinct-owner capital, tenure, and fees actually paid, so history is expensive to fake. Wash-delegation — an operator's own owner funding its mandates to farm history — clusters and de-weights. The score is computed off-chain by Float initially so the model can iterate, with raw receipts always available for anyone to score independently.
3. Bonds — operators stake collateral against their mandates, slashed on attempted policy violations. Skin in the game turns the score from descriptive to underwritable.
4. Credit — the terminal product: agents and operators borrowing against reputation. Owners lend; proven operators borrow; the score gates access. Credit begins fully collateralized and collateral requirements ratchet down as bonded, receipt-backed history deepens — progressive collateralization, because uncollateralized crypto credit has failed everywhere the underwriting data didn't exist first. Markov does not launch a money market; it makes existing and future credit venues able to price operators.

Enforcement is the business today; underwriting and credit are the businesses the data makes possible — and they cannot be built in any other order.

Open core. The protocol and the operator SDK are open source and never credit-gated: anyone can bring their own keys and infrastructure and run mandate-constrained execution with nothing else. The hosted product — Float — carries what genuinely belongs hosted: billing, managed infrastructure, premium analytics, and x402 monetization of hosted endpoints. Openness is the adoption strategy; the hosted surface is the business.

No token at launch. Fees accrue in the assets they're earned in. A token is a distribution decision, not a revenue model, and it is deferred until it has a job to do.

8. Why Solana, Why Now

The chain fits the primitive. Per-action policy validation means every operator instruction passes through an extra program hop. Sub-second finality and sub-cent fees make that overhead economically invisible; on most chains it would dominate strategy costs.

The agent economy is concentrating here. x402 activity on Solana has scaled from zero to tens of millions of transactions inside a year, the Solana Foundation is shipping first-party agentic payment infrastructure, and the network holds $15B+ in circulating stablecoins — the settlement asset of machine commerce. The capital and the machines are already in the same place; what's missing is the authority layer between them.

The roadmap points this way. Solana's protocol direction (application-controlled execution) is explicitly toward applications encoding and proving their own execution policies. Markov is that idea applied to delegated capital, live at the program layer today.

The timing is post-hype. Agentic-payment volume went through a speculative peak and a deep correction before resuming growth in larger, stickier transactions. That shakeout is the signal: the surviving demand is real usage, and real usage is exactly the demand that needs enforcement, receipts, and recourse.

9. Landscape

Smart-account policy tooling (multisigs, session keys, spending limits) governs your own keys. It answers "how do I limit myself," not "how do I let a stranger operate my capital." No adversarial delegation, no track-record output.

Vault protocols offer delegation into a fixed strategy envelope. Real products, narrow primitive: no general policy surface, no operational-spend governance, no portable receipts across contexts.

Off-chain policy engines (key-management platforms) enforce rules on servers. Effective inside one organization's trust boundary; unusable between strangers.

Custodial copy-trading solves discovery and gives up the core property: the user's funds sit with the venue.

Markov's position: adversarial delegation, general policy, portable receipts — the intersection none of the above occupies. The honest competitive risk is incumbents extending downward: a multisig platform could add third-party delegation; a vault protocol could generalize policy. The defense is being the neutral layer none of them can be for each other, and compounding the receipt graph before anyone else starts.

10. Threat Model and Fallbacks

Markov's safety posture is prevention by construction where possible, economic deterrence where not, and strictly protective emergency powers everywhere. Threat by threat:

Rug (operator exfiltrates funds). Prevented by construction, not detection: no code path exists from operator authority to withdrawal or to a non-allowlisted program. There is nothing to steal through, so there is nothing to monitor for.

Rogue execution (illiquid dumps, self-dealing, wash trades). Token and venue allowlists bound what can be touched; notional caps bound size; slippage bounds are enforced at CPI time. Residual self-dealing (an operator trading against a market it controls) is constrained by venue-level policy and fully visible in receipts — it damages the score it was meant to inflate.

Marketplace spam (fake or throwaway operators). Listing requires a stake/fee; ranking requires minimum receipt history under real capital; Float curates at launch. Empty reputations cost more to fabricate than they can earn.

Score farming / sybil (wash-delegation). Addressed in the score design itself: distinct-owner weighting, tenure, and fees-paid make farmed history expensive and clustered self-funding detectable and de-weighted.

Abandonment (operator goes dark holding positions). Mandates expire by default, and revocation transfers full position control to the owner — revoke means take over, not freeze. An owner can always unwind through the same adapters the operator used.

Operator key compromise. If an operator's key is stolen, the attacker inherits exactly the operator's authority: policy-bounded actions on allowlisted venues, nothing more. No withdrawal path exists, caps and allowlists still bind, and the owner revokes on the first anomalous receipt. The blast radius of a stolen key is a design parameter here, not a catastrophe — the structural difference from any architecture where the signing key can move funds.

Venue failure (exploit in an allowlisted program). Blue-chip-only initial allowlist, per-venue exposure caps, and rapid de-listing. De-listing restricts operators only — it can never impede owner withdrawal.

Protocol failure (bug in Markov itself). Policy validation fails closed. Audit precedes mainnet value; launch is guarded with capped mandate sizes.

The emergency-powers principle. Every administrative or emergency capability in the system is strictly protective of owners: it may restrict operator authority, and it may never delay, gate, or restrict an owner's withdrawal. Any proposed mechanism that violates this principle is rejected regardless of what it protects against.

Open Risks

Demand timing. Agent-managed AUM is small today. Markov is early — deliberately — and hedged: the identical primitive serves human delegation (strategists, copy-trading, treasury operators) immediately, so the protocol doesn't wait for the agent economy to justify itself.

Operator adoption tax. Routing execution through a CPI wrapper constrains how strategies are written. If the adapter cost exceeds the value of allocable capital plus provable history, operators won't integrate. Mitigation: an SDK that makes mandate-constrained execution the easy path, and first-party agents proving the pattern.

Security surface. The mandate program is a high-value target by design — it is the thing standing between operators and other people's money. Formal review and audit precede any mainnet value; policy checks are designed to fail closed.

Deferred risk limits. v1 cannot enforce drawdown or exposure limits, and says so. Owners mitigate through venue/token allowlists, caps, and revocation until oracle-dependent policy ships in v2.

Regulatory adjacency. Operators managing third-party capital may face investment-adviser or similar obligations depending on jurisdiction. Markov is neutral infrastructure enforcing owner-set policy and does not intermediate custody; operator compliance is the operator's obligation. This is a design consideration, not legal advice.

11. Roadmap

Phase 0 — proof (hackathon window). Devnet mandate program: create/fund/amend/revoke, program and token allowlists, per-tx and daily caps, x402 spend budget, action and refusal receipts with machine-readable block reasons. Float web app (marketplace + console + kill switch) and bot. Two first-party agents live under real mandates, built on the embryonic public operator SDK. End-to-end demo: fund a mandate, watch an agent trade and pay for data under policy, watch the program refuse an over-cap attempt with the reason on screen, revoke mid-flight.

Phase 1 — mainnet beta. Audit. Operator SDK hardened and published; client SDK; MCP server and agent skill files; receipts index API. Copilot mode (per-action owner approval on the same rails). Launch radar. In-program fee settlement and the protocol fee switch. Guarded mainnet launch with capped mandate sizes.

Phase 2 — scale and depth. Pooled mandates: many owners delegating to one operator, with share accounting and oracle-based NAV — the structure that scales AUM. Perp/derivatives venue adapters with leverage and position caps. Prediction-market adapters where CPI-able venues exist. Score SDK: the versioned reference scoring model, evidence bundles, and the hosted x402-metered index. Oracle-backed portfolio limits (drawdown, exposure). Verifiable execution attestation (TEE-based first, zero-knowledge as costs allow). Recourse primitives for machine commerce — escrow and refund flows for x402 spend under mandate.

Phase 3 — the credit layer. Formalized operator score. Operator bonds and slashing. Progressive-collateralization credit lines: proven operators borrow against bonded, receipt-backed track record, with collateral requirements declining as history deepens.

Phase 0 scope is frozen. Every later phase builds on it; nothing moves into it.

12. What We Measure

Total value mandated (TVM). Active mandates and unique owners. Integrated operators and receipts per day. Revocation rate — a trust signal, not a vanity metric: healthy revocation means owners exercise control. Operator fee flow, from which protocol revenue follows.