Confidential Guardrails

The Problem

A naive treasury stores daily_limit_usd = 10_000 in a public Solana account. Any observer can read it, infer the agent's strategy, and front-run or manipulate it. AURA solves this with Fully Homomorphic Encryption (FHE) via the Ika Encrypt network — the limit value is stored as an EUint64 ciphertext and never decrypted during evaluation.

What Gets Encrypted

The core confidential path attaches three scalar EUint64 ciphertext accounts to a treasury via configure_confidential_guardrails:

These are Solana accounts owned by the Ika Encrypt program. Their addresses are stored in the TreasuryAccount and passed as accounts to every confidential instruction.

The newer ConfidentialGuardrailsAccount sidecar adds an epoch marker, an enabled flag, and optional expanded ciphertext pointers. Current proposal execution uses that sidecar for the extended weekly-limit path when both weekly_limit_ciphertext and weekly_spent_ciphertext are supplied.

Instruction Flow

CPI Accounts for propose_confidential_transaction

The instruction requires these accounts beyond the standard treasury/AI authority pair:

What the FHE Circuit Does

The default Ika Encrypt graph evaluates a circuit over the four core ciphertexts:

verdict = if (amount > per_tx_limit) → PerTransactionLimit
          else if (spent_today + amount > daily_limit) → DailyLimit
          else → None (approved)

When the weekly ciphertext accounts and sidecar are supplied, aura-core submits the extended graph:

verdict = if (amount > per_tx_limit) → PerTransactionLimit
          else if (spent_today + amount > daily_limit) → DailyLimit
          else if (weekly_spent + amount > weekly_limit) → WeeklyLimit
          else → None (approved)

The output carries an encrypted violation code and update lanes for the encrypted counters. Only the small violation code and validated counter update are consumed on-chain; the limit values remain encrypted.

What Stays Private

Public Precheck Before FHE

evaluate_public_precheck runs before the FHE CPI. Current source evaluates the public subset: scoped pauses, budget envelopes, Bitcoin manual-review threshold, time window, protocol allowlist, slippage, quote freshness, counterparty risk, shared pool, velocity, and approval ladder. It skips direct per-transaction, daily, weekly, monthly, and recipient cap checks; encrypted per-tx/daily checks are always deferred to Encrypt, and the weekly check is included only in the extended sidecar path. If any public rule fails, the proposal is rejected immediately — no FHE call is made, saving compute and cost.

Decryption Accounts for request_policy_decryption

SDK Usage

import { instructions } from "@aura-protocol/sdk-ts";

// Configure confidential guardrails (owner signs)
await instructions.confidential.sendConfigureConfidentialGuardrails(client, owner, {
  accounts: {
    owner: owner.publicKey,
    treasury,
    dailyLimitCiphertext,
    perTxLimitCiphertext,
    spentTodayCiphertext,
  },
  args: { now },
});

// Propose a confidential transaction (AI authority signs)
await instructions.confidential.sendProposeConfidentialTransaction(
  client,
  aiAuthority,
  {
    accounts: {
      aiAuthority: aiAuthority.publicKey,
      treasury,
      dailyLimitCiphertext,
      perTxLimitCiphertext,
      spentTodayCiphertext,
      amountCiphertext,
      policyOutputCiphertext,
      weeklyLimitCiphertext: null,
      weeklySpentCiphertext: null,
      confidentialGuardrails: null,
      encryptProgram: ENCRYPT_DEVNET_PROGRAM_ID,
      config: encryptConfig,
      deposit: depositAccount,
      callerProgram: AURA_PROGRAM_ID,
      cpiAuthority: deriveEncryptCpiAuthorityAddress()[0],
      networkEncryptionKey,
      eventAuthority: deriveEncryptEventAuthorityAddress(ENCRYPT_DEVNET_PROGRAM_ID)[0],
      systemProgram: SystemProgram.programId,
    },
    args,
  },
);