Architecture

Decide off chain.Enforce on chain.Fail closed everywhere.

Four planes with explicit boundaries. Compromise of the control plane must not expose signing keys or permit unauthorized policy changes.

Schema 1.0 · pre-release · not deployed

Execution path01

AI agent / application
Proposed action · typed intent
SDK + API gateway
Authentication · schema validation · replay protection
Deterministic authorization boundary
Policy engine · serialized budget state · simulation · signing authorization
■ DENY
No broadcast
◆ REVIEW
Pending, unsigned
→ ALLOW
Authorized signing
Smart account · ERC-4337 validation
On-chain enforcement · bundler · Robinhood Chain

Intended flow. On-chain enforcement, signer authorization and bundler compatibility must be implemented and tested before bypass prevention is claimed.

Planes02

Control plane

Organizations and members
API credentials
Policy authoring and activation
Human approvals
Billing metadata

May be compromised. Cannot bypass on-chain authorization.

Enforcement plane

Policy evaluation
Authoritative reservations
Authorization decisions
Protected signing

Security-critical. Deterministic, versioned, adversarially tested.

Chain plane

Smart-account validation
Bundler submission
RPC connectivity
Receipts and reorgs

External dependencies validated; fails safely.

Observability plane

Redacted event delivery
Audit records
Aggregate analytics
Alerting

Never the source of truth for authorization.

Corrections to common assumptions03

A dropped transaction is not an EVM revert.

Pre-broadcast denials return a structured JSON-RPC error with a stable code and no transaction hash.

A gateway cannot secure a key it does not control.

Protection requires a smart account with enforced validation or another cryptographic boundary.

PCR attestation is not enforced by an EVM contract.

Contracts trust an explicitly registered signer. Attestation binds that signer to a measured build off chain.

ArbSys is not a universal fee oracle.

Fees are estimated from Robinhood Chain's own RPC and fee model, once confirmed.

Trust boundaries04

Component	Assumption	Safeguard
Agent / LLM	Untrusted	No independent unrestricted signing authority
Public API	Hostile input	Authentication, validation, quotas, replay protection
Control-plane server	May be compromised	Cannot bypass on-chain authorization
Policy engine	Security-critical	Deterministic, versioned, adversarial tests
TEE	Trusted within hardware assumptions	Attestation, measured builds, narrow interface
State database	May fail or go stale	Atomic reservations, integrity checks, recovery
RPC / bundler	External	Validate responses, reconcile receipts
Human approver	Authorized but fallible	Exact transaction details, independent signature
Smart account	Enforced boundary	Audited validation, bypass-resistance tests

Component

Assumption

Safeguard

Agent / LLM

Untrusted

No independent unrestricted signing authority

Public API

Hostile input

Authentication, validation, quotas, replay protection

Control-plane server

May be compromised

Cannot bypass on-chain authorization

Policy engine

Security-critical

Deterministic, versioned, adversarial tests

TEE

Trusted within hardware assumptions

Attestation, measured builds, narrow interface

State database

May fail or go stale

Atomic reservations, integrity checks, recovery

RPC / bundler

External

Validate responses, reconcile receipts

Human approver

Authorized but fallible

Exact transaction details, independent signature

Smart account

Enforced boundary

Audited validation, bypass-resistance tests