Trust & Agents

Multi-agent support, trust tiers, reputation scoring, and ownership handover for AURA treasuries.

AURA supports multi-agent treasuries with a trust envelope. Instead of a single AI authority, treasuries can register secondary agents with scoped capabilities, track capability breaches, and apply trust-tier multipliers to the policy engine.

Trust Tiers

The trust system classifies agent behavior into four tiers stored in a TrustIdentityAccount:

Tier	Name	Impact	Path In	Path Out
0	Trusted	1.0× multiplier	Default state	Threat score crosses `watch_threshold` → Watch
1	Watch	`watch_multiplier_bps` (default 0.5×)	Threat score crosses `watch_threshold`	Decay or `restore_trust` → Trusted
2	Restricted	`restricted_multiplier_bps` (default 0.1×) + forced multisig approval	Threat score crosses `restricted_threshold`	`restore_trust` → Watch
3	Lockdown	Proposal path blocked when `TrustIdentityAccount` is supplied	Threat score crosses `lockdown_threshold`	`restore_trust` → Restricted

The implemented proposal path registers behavior signals when a secondary agent breaches its capability manifest. Clean activity decays threat_score; Lockdown does not auto-clear. restore_trust is owner-gated in the current accounts and steps the tier down by one.

Trust multipliers

Daily limits are scaled by the trust tier multiplier before policy evaluation. A treasury with dailyLimitUsd = 10000 at the default Watch multiplier operates at 5000 effective daily limit.

Agent Registration

Treasuries register secondary agents via register_agent, specifying:

import { instructions } from "@aura-protocol/sdk-ts";

await instructions.lifecycle.sendRegisterAgent(client, owner, registerAgentInput);

Key features:

Agents can be restricted by chain, transaction type, protocol bitmap, active window, and per-transaction cap
Recipient and asset allowlists are represented by address-list accounts and enforced on the evaluator path
The primary ai_authority remains authorized even when secondary agents are registered

Capability Manifests

Agent capabilities define fine-grained permissions through a CapabilityManifest:

await instructions.lifecycle.sendSetAgentCapability(
  client,
  owner,
  setAgentCapabilityInput,
);

Tightening vs. Loosening:

Tightening (reducing permissions) applies immediately
Loosening (expanding permissions) requires arming a timelock via arm_capability_loosen and waiting for it to elapse

Capability changes that expand agent power are timelocked to prevent compromised agents from escalating their own privileges.

Tripwires & Behavior Monitoring

Tripwire configuration stores the behavior-signal weights used by the trust engine:

await instructions.lifecycle.sendSetAgentTripwires(
  client,
  owner,
  setAgentTripwiresInput,
);

Stored weights:

Policy denial
Anomaly
Fail-open abuse
Approval miss

Current proposal enforcement increments threat score on secondary-agent capability breaches. The other weights are stored for the trust engine surface and future signal integrations.

Ownership Handover

Transfer treasury ownership securely with a timelocked nomination:

// 1. Nominate successor (48h timelock)
await instructions.lifecycle.sendNominateSuccessorOwner(client, owner, nominateInput);

// 2. Execute after the timelock elapses.
await instructions.lifecycle.sendExecuteOwnershipHandover(
  client,
  owner,
  handoverInput,
);

Safety:

48-hour timelock on nomination
Owner or any registered guardian can nominate/execute under the current account constraints
execute_ownership_handover transfers one dWallet at a time; set finalize = true on the last call to decommission the old treasury

Emergency Agent Revocation

Instantly disable a compromised agent:

await instructions.lifecycle.sendEmergencyRevokeAgent(
  client,
  ownerOrGuardian,
  revokeInput,
);

Unlike revoke_agent, emergency_revoke_agent applies immediately and can be called by the owner or any registered guardian.

Checking Trust State

Read the trust tier and history from the TrustIdentityAccount:

import { accounts } from "@aura-protocol/sdk-ts";

const trustAccount = await accounts.fetchTrustIdentityAccount(client, trustPda);

console.log("Current tier:", trustAccount.trustTier); // 0-3
console.log("Threat score:", trustAccount.threatScore);
console.log("Last clean activity:", trustAccount.lastCleanActivityAt.toString());
console.log("Tier entered at:", trustAccount.tierEnteredAt.toString());

Use Cases

Multi-agent treasuries:

Separate trading, yield, and payment agents with different capabilities
Independent daily caps per agent
Automatic trust degradation if one agent behaves anomalously

Ownership transitions:

Sunset a development keypair and hand treasury to production infra
Migrate from custodial to self-hosted agent infrastructure
Transfer ownership after acquisition or team change

Compromise response:

Emergency revoke suspicious agent
Move the trust envelope into Lockdown so proposals using the trust PDA are blocked
Owner restores the trust tier after investigation

init_trust_identity — Initialize trust tracking
configure_trust_policy — Set tier thresholds and decay
restore_trust — Owner-gated tier step-down
register_agent — Register secondary agent
revoke_agent / emergency_revoke_agent — Disable agent
set_agent_capability — Update capability manifest
set_agent_tripwires — Tune behavior monitoring weights
nominate_successor_owner / execute_ownership_handover — Ownership transfer

On this page