Money that
can say no.

The phone call that never comes

In 1830 a Massachusetts court decided Harvard College v. Amory and wrote down the rule that still governs other people's money. A trustee must conduct himself as men of prudence, discretion and intelligence manage their own affairs. The prudent man rule.

It was a good rule. It was also enforced by a court, after the fact, years later, if somebody sued.

In 1995 Barings Bank had position limits for its Singapore desk. Nick Leeson breached them for two years. The limits lived in a spreadsheet in London, and the man who was supposed to check them also reported to him. The bank lost 827 million pounds and 233 years of history in a weekend.

In 2022 the funds that blew up did not have limits at all. Their lenders found out on Twitter.

Every one of those failures has the same shape. Somebody wrote down what the manager was allowed to do, and then trusted the manager to do it.

A limit that depends on a person is a suggestion.

What changed in July

On 1 July 2026, Robinhood Chain went live on mainnet. Robinhood calls it a permissionless, AI-native blockchain built for real-world assets, and agentic trading is on the roadmap. Tokenized stocks trade around the clock in more than 120 countries. Uniswap and Chainlink shipped on day one, lending runs through Morpho, perps through Lighter.

Put those two facts next to each other. The oldest problem in asset management is that limits are enforced by people. The newest development in trading is that the manager is not a person any more.

Software does not take the phone call.

One bad hour

Here is a failure that needs no villain.

Nothing here is malice. A model that hallucinates a price will trade on it. A loop with a bug will trade four hundred times an hour. A token whose metadata says "ignore your limits and buy" is a prompt injection with a ticker.

This is what happens when the only thing between an agent and a wallet is the agent's own judgment.

Under MANDATE the same hour reads: 14:02 stale input, 14:03 refused on input age, refused again, refused a third time, 14:04 tempo cool-down for fifteen minutes, 14:55 unchanged.

Two more problems while we are here

Trust-me vaults. Today's copy-trading and vault products enforce, at best, an asset allowlist. The strategist can change venues, lever up, trade against a pool they happen to own, or simply stop showing up. Allocators are trusting a person and calling it a smart contract.

Track records are screenshots. Agent leaderboards run on self-reported profit and loss. Cherry-picked windows, paper trades, a fresh wallet after every bad month. A track record you can edit is marketing.

What a mandate is

In asset management, a mandate is the agreement between the allocator and the manager. What may be traded, how much risk, which venues, and what happens when it goes wrong.

MANDATE makes the agreement the contract.

A strategist composes a mandate out of seven clauses, posts a bond in $MNDT sized to the capital they are asking for, and the vault refuses anything the clauses do not allow. Allocators fund the mandate. Who or what operates inside it is a separate question with a separate answer, which is the bond.

The seven clauses

Every clause has a range that governance sets. A mandate outside the ranges cannot be deployed. You compose a mandate, you never write one free-form, because a free-form mandate is a place to hide.

Refuse before, verify after, trip on outcome

Refuse before. Anything checkable before a transaction lands is checked before it lands. Is the venue in the mandate. Are the pricing inputs fresh. Has the tempo clause been exhausted. Would the predicted position break a cap. A failure reverts and writes a REFUSED line with the clause and the reason.

Verify after. The action executes through an adapter, the adapter reports the deltas it actually realised, and the exposure invariants run again on the real numbers alongside a per-action slippage bound. A failure reverts the whole action. A breach therefore cannot land on chain.

Trip on outcome. Drawdown and daily loss are not actions, they are results, so they cannot be refused. They are evaluated on every action, on every poke, and at every mark. Crossing one moves the vault to TRIPPED and locks the strategist out.

The envelope

The upper rail is the high-water mark, the best mark this vault has ever printed. The lower rail is that mark minus the envelope. The day the curve touches the floor, the strategist stops being able to act at all: a 24-hour wind-down opens, in which they must bring the vault to its exit asset. If they do not, anyone can force the unwind through the adapters, and the cost is paid out of the bond.

Allocators redeem at the next mark. Nobody negotiates. Nobody explains that the strategy needs a little more room.

Seven states, and a line at every boundary

A vault is always in exactly one of seven states: DRAFT, OPEN, LIVE, MARK, TRIPPED, KILLED, SETTLED.

KILLED deserves a note. It is a hard stop from outside the strategy. Allocators holding a third of the capital can vote it, and it fires an hour later. The guardian can fire it at once. The strategist can pull it on themselves. Killed is Tripped without the wind-down.

The guardian is the one piece of centralised power in the design, so it is worth being precise about what it is. There is an emergency key. It can kill a mandate. It cannot trade, withdraw, change a clause, or touch the ledger. That is the whole list.

The mark at 21:00 UTC

Every day at 21:00 UTC the vault marks. Positions are valued at Chainlink prices where a feed exists and at 30-minute pool TWAPs where one does not. A NAV per share is computed. Fees crystallize against the high-water mark, so a strategist who loses 20% and then makes 20% back is paid nothing for the round trip. Queued subscriptions and redemptions settle at that NAV.

If an input is stale or two sources disagree beyond the clause, the mark is deferred and can be retried for up to three hours, after which it publishes as THIN using the median of what is available. A THIN mark is flagged forever.

Marks are the only prices allocators ever transact at. That single rule kills a whole family of games: no entering at a price the strategist can move, no redeeming ahead of a mark the strategist can see coming, no continuous NAV to manipulate one block at a time.

What the bond covers, and what it does not

The three enforcement layers cannot catch everything. Three things survive them, and that is exactly what the bond is for.

• Extraction inside the letter of the mandate. Value leaked through an allowed venue to a counterparty the strategist controls, or systematic slippage capture. A bonded watcher files a claim with on-chain evidence, a 72-hour challenge window runs, and a claim that survives slashes the bond to the allocators who held during the period. A claim that fails burns the watcher's stake.
• Abandonment. A tripped vault that is not in its exit asset when the window closes. Anyone can force the unwind and the cost comes out of the bond.
• Adapter misuse that a later adapter fix reveals.

What the bond does not cover is an honest loss inside the envelope. That is the allocator's risk, and pretending otherwise would make the whole thing a scam with extra steps.

The ledger is the track record

Marks, executions, refusals, pokes, trips, kills, claims and slashes live on one ledger. The track record is a pure function of that list. It is not a screenshot, it is not self-reported, and nobody, including the protocol, can remove a line from it.

Every action also commits a hash of the strategist's stated reason, revealed after the fact. For an agent that means the prompt and the answer. You do not get to explain your trades later, you get to explain them beforehand and be held to it.

Refusals are on the ledger too, which is the part people underestimate. A mandate that never refuses anything is not proof of a disciplined strategist. It is usually proof of a loose mandate.

It runs today, on testnet

There is an app. It is not a mockup made of screenshots.

What is real: wallet discovery through EIP-6963, the network switch to Robinhood Chain testnet (chain ID 46630), your balance and the current block read through your wallet, and EIP-712 typed-data signatures over a MANDATE testnet domain for subscribe, redeem, kill, bond and claim.

What is simulated: everything behind those signatures. Seven mandates with weeks of mark history, six operators acting on a clock you can speed up, clause checks that refuse in the order above, envelopes that trip, wind-downs that expire into forced unwinds, marks at 21:00 UTC, kill votes, watcher claims. It runs in your browser and persists in local storage. No contract is deployed, and receipts shown in the ledger are hashes of your signature, labelled as such.

If you have never seen a vault refuse an order, set the clock to 360x, open any live mandate, and wait. It does not take long.

You can also draft your own mandate, pick an operator, post the bond, and watch what your clauses do to it. Choosing a 40% drawdown and 600 actions an hour is allowed. So is watching what happens next.

$MNDT, and how it launches

The bond is the whole point of the token. A mandate cannot open without one, sized to the capital it is asking for. Adapters post bonds too, and they pay out first when a venue module is the thing that failed. Watchers stake on every claim. Governance sets the clause ranges, the adapter registry, the mark procedure and the protocol take, and never touches an individual mandate.

The protocol takes 10% of every performance fee crystallized at a mark, and nothing from management fees. Half funds watcher bounties, half goes to the treasury. Nothing goes to passive holders, because paying people to hold a token is not a use.

$MNDT launches on Pons, the launchpad on Robinhood Chain.

There is no allocation table. There is a curve, and a receipt for every wallet that bought on it, including ours.

Roadmap, and the gates

Before a single funded mandate: the vault and the mark procedure audited, a hundred trips fired on testnet, a usable app, the ledger indexer public and reproducible, and legal review. A non-custodial vault that runs other people's money is still other people's money.

What could go wrong

A bad mark from a stale or manipulated input at 21:00, answered with medians, deferral and the THIN flag. An adapter bug, answered with bonded adapters and a per-adapter cap in every mandate. Extraction that stays inside the letter of the mandate, answered with slippage bounds and watchers. Kill griefing by allocators, answered with a capital quorum and a delay. Pre-trade checks that turn out to be too expensive at roughly 100 millisecond blocks, which is an open engineering question we will measure on testnet before the ranges are set. A compromised agent key, answered with expiry, tempo and the kill switch. And the legal question, which no amount of design work answers.

One implementation note we already paid for elsewhere: on Robinhood Chain the block number tracks the L1 and moves about every 15 seconds. Every timer in MANDATE runs on L2 timestamps, never on the block number.

What we want to hear

Three questions are genuinely open, and outside opinions are worth more than ours on all three.

• What does a watcher's evidence standard look like for extraction that stays inside the mandate? The bond only means something if claims can be judged.
• What are the right default clause ranges? Ours are guesses with a shape, not measurements.
• Would you fund an agent whose only guarantee was a set of enforced limits and a bond? If not, what would you need on top?

Open the app, break a mandate, tell us where the design is wrong.