The model never holds the keys.
Agent vaults. Guardrails in the contract, not the prompt.
Rienda is a smart-contract vault for LLM trading agents on Robinhood Chain, an Ethereum L2. The vault holds the money and the model never does: capital sits in the contract, the risk policy is enforced there too, and the agent holds a session key that can submit trade intents and nothing else. Losses get bounded, not prevented.
A session key that can trade. Never withdraw. Never change policy.
Prompt-level guardrails fail the moment the model is jailbroken, hallucinating, or simply wrong. Rienda assumes all three will happen and puts the guardrails where the model can't reach them: in the vault contract.
The vault holds the capital
Deposits sit in the vault contract, owned by the vault owner. The agent has no custody, no withdrawal path, and no way to grant itself one.
The agent holds a session key
The session key can do exactly one thing: submit trade intents to the vault. It cannot withdraw funds, cannot change policy parameters, cannot add itself as an owner.
The contract decides
Every intent is checked against the ten guardrails below before execution. A compliant intent executes; a non-compliant one reverts. The model proposes, the contract disposes.
Contract code, not prompt engineering.
Each guardrail is a check the vault runs on every trade intent. They compose: an intent has to pass all ten to execute. None of them can be talked around, because none of them read the model's output — only its orders.
Max position size per asset
No single asset can exceed a configured share of the vault. An intent that would push a position past its cap reverts — the trade never happens.
Max gross exposure
Total exposure across all positions is capped. The agent can't concentrate the whole vault into open risk, however confident the model sounds.
Daily realized loss limit
Once realized losses hit the day's limit, the vault accepts risk-reducing intents only until the daily window resets. A bad day stops being a worse one.
Drawdown throttles
Drawdown past the first threshold halves permitted sizing. Past the second, the vault goes risk-reducing-only. Recovery has to be earned at reduced size.
Venue and asset whitelist
The vault trades whitelisted assets on whitelisted venues, nothing else. An intent naming an unknown token or route reverts.
Order rate limit
A hard cap on intents per time window. A model stuck in a loop — or manipulated into one — burns its rate budget, not the vault.
Oracle price sanity band
Intents priced outside a band around the oracle price revert. Fat-fingered limits and manipulated quotes fail the same check.
Market-hours rule
For tokenized equities: no position increases while the underlying market is closed. Risk-reducing intents still pass — you can always get smaller.
No leverage, structurally
The vault cannot borrow. There is no margin, so there is no margin call, no liquidation cascade, no path to owing more than the vault holds.
Owner / guardian kill switch
The vault owner — or a designated guardian — can halt trading and withdraw at any time. The agent sits below the kill switch and can never block an exit.
Agents that don't earn, don't think.
Inference costs money, so Rienda meters it against performance. Each day the agent gets an inference allowance: a survival minimum plus a share of the 7-day exponential moving average of its realized PnL, hard-capped at the top. The allowance is spent via x402 — the same pay-per-call rail that runs underneath — one signed receipt per call.
Realized PnL only
Unrealized gains buy nothing. A position that looks good on paper doesn't fund a single inference call until it closes at a profit.
Hard-capped upside
A hot streak raises the budget only to the cap. No amount of profit turns the agent into an unmetered spender.
Hibernation
Sustained losses shrink the allowance toward the survival minimum. In hibernation the agent may only submit risk-reducing intents — enough compute to get smaller, not to dig deeper.
Auto wind-down
If losses persist through hibernation, the vault winds the agent down: positions close, capital returns to the owner. The strategy dies; the money doesn't.
The honest framing: this bounds losses, it does not prevent them. An agent can lose up to its configured limits before the throttles bite, and the design assumes most trading strategies lose money — that assumption is why the budget exists.
Every trade traces back to the reasoning that produced it.
Each inference call the agent pays for returns an Ed25519-signed SIR v2 receipt — prompt hash, response hash, model, cost. Each trade the vault executes links to the receipt of the inference that proposed it. The audit log isn't "the agent traded"; it's "this exact model output, verifiable against this exact receipt, produced this exact trade." When a strategy gets reviewed — by its owner, or by anyone the owner shows it to — the chain of decisions is checkable end-to-end without trusting us.
Where it stands.
No dates, no performance claims, no token promises beyond what the launch-gated token pages already state. What exists today:
Nothing described on this page accepts deposits today. The contracts deploy to Robinhood Chain testnet (chain id 46630) before any mainnet deployment, and mainnet waits for both the audit and the legal review — however long that takes.
/live reads the testnet directly — vault state, guardrail headroom, and every event the vaults emit. It is empty until the deploy lands, and it says so rather than showing a preview.