An AI agent can now run a prime book without custody.
An agent borrowed from an unrelated lender, opened margin exposure, lent onward to another agent, and repaid the lender first under stress.
No private keys changed hands. No custodian took control. No credit score existed. The lender underwrote signed, enforceable authority — and the agent operated a full credit book inside it.
This is the core shift: once an agent's authority is bounded on-chain, counterparties can price what it can draw, where risk can sit, when the book is liquidated, and who gets paid first.
Atlas turns bounded authority into agent credit infrastructure.
Agents do not just need wallets. They need financeable roles.
Borrower.Trader.Risk manager.Counterparty.
Atlas turns signed authority into a book counterparties can price.
01
Finance needs priceable counterparties. Agents are not priceable today.
Credit markets do not require perfect trust. They require measurable downside.
Traditional finance measures downside through legal identity, repayment history, courts, payrolls, collateral, and institutional relationships. Autonomous agents have none of these. They also cannot build them in the normal way.
A clean history is not enough: if an agent's actions are already constrained by software, past compliance mostly proves the constraint worked. Identity is not enough either: a new wallet is cheap, so a name alone does not carry liability.
The result is simple: an agent may be useful, but it is not yet a creditworthy counterparty.
Today, agent finance has two default models.
DOOR ONE
Give the agent control
The agent can act freely, but the downside is everything it can access.
A COUNTERPARTY SEES → unbounded authority
DOOR TWO
Enforce policy off-chain
A server, wallet service, or API applies limits outside the settlement layer.
A COUNTERPARTY SEES → no enforceable bound
Both models fail for credit. In one, the agent has too much authority. In the other, the authority limit is not externally legible or enforceable. Either way, a lender, venue, or client cannot price the agent.
THE RESULT → what cannot be priced cannot become a market.
02
On-chain bounds make agent risk underwritable.
The missing primitive is not agent reputation. It is enforceable, legible authority.
When an agent's limits are enforced on-chain, the bound becomes a financial object. A counterparty can read the maximum draw, permitted venues, repayment priority, liquidation rules, and downstream delegation rights — before capital moves.
That changes the underwriting model.
The lender does not need to believe the agent.
The lender does not need custody.
The lender does not need a credit score.
The lender prices the bound.
Tighter bounds reduce downside. Lower downside supports larger credit lines. Credit becomes a function of enforceable authority, not trust.
Atlas is that layer: bounded authority as an on-chain object. One ERC-7710 delegation, redeemed through MetaMask's canonical DelegationManager. Caveats enforced at execution. Portable across venues. Attenuable to sub-agents. Readable by any counterparty.
The agent never holds private keys. The principal never gives up custody. The counterparty can verify the authority envelope. That is the primitive: non-custodial credit for autonomous agents.
03
The current agent stack protects users. It does not make agents financeable.
Most agent infrastructure answers one question: can this agent act safely on behalf of its user?
Credit requires a different question: can an external counterparty price this agent's downside? That is a lower layer.
ORCHESTRATION
Agent frameworks & SDKs
Frameworks such as LangChain, CrewAI, and Eliza decide what the agent should do. They do not create a financeable authority model.
A COUNTERPARTY CAN PRICE → nothing
EXECUTION
Policy wallets & hosted controls
TEE-held keys, transaction screening, 2FA approval flows, and service-enforced spend limits protect the principal — but the policy is enforced off-chain.
A COUNTERPARTY CAN PRICE → nothing enforceable at settlement
ACCOUNT
Session keys & scoped permissions
Per-app permissions are useful, but limited: venue-specific, balance-based, and not designed for aggregate credit, cross-venue risk, or downstream delegation.
A COUNTERPARTY CAN PRICE → one narrow scope, at best
AUTHORITY
The envelope — Atlas
The authority envelope itself, enforceable on-chain: portable, aggregate, attenuable, and externally legible.
A COUNTERPARTY CAN PRICE → max draw, approved venues, repayment priority, risk triggers, delegation hierarchy
Wallets make agents safer for users. Atlas makes agents priceable to counterparties.
Frameworks decide what the agent wants to do. Wallets constrain how it executes. Atlas defines what it is allowed to become liable for. A wallet policy may protect the user, but it does not give a lender an enforceable underwriting surface. Atlas does.
04
Once agent authority is priceable, a prime book becomes possible.
The same primitive unlocks the core functions of prime brokerage: financing, margin, client clearing, and the lender repaid first. They are not separate demos. They are one book.
The agent finances the book with undercollateralized credit. It uses that credit to open margin exposure without taking custody. It grants hedge authority to another agent through a smaller permission. And when the book is stressed, the liquidation path repays the lender first.
That is the product shape: a non-custodial prime brokerage agent. The demo is that agent. The category is agent credit infrastructure.
A · FINANCING — ACT 1
Undercollateralized credit
WHY IT WAS BLOCKED
An unpriceable agent cannot borrow on credit. It can only spend its own balance or post excess collateral.
WHAT CHANGES
The borrower gets capital. The lender gets an enforceable liquidation. The agent posts collateral; the lender funds the senior line; the bound controls repayment, risk triggers, and unwind priority. The lender underwrites repayment, not reputation — in the demo, an unrelated lender funds the agent's working line against its posted collateral.
WHAT THIS BECOMES
Programmatic credit lines for agents. Rate curves based on authority parameters. Syndicated agent lending. Term sheets expressed as executable caveats.
B · MARGIN — ACT 2
Margin exposure without custody
WHY IT WAS BLOCKED
Margin trading normally requires custody or venue lock-in. Capital sits with a venue, broker, or manager — and a credit ledger cannot see margin posted at another venue, so financing it meant trusting the agent.
WHAT CHANGES
The agent opens margin exposure at a second venue using credit-financed capital — but borrowed capital never becomes loose custody: the draw is receiver-pinned from the credit venue into venue margin, and payouts can land only at the pinned settlement. The agent controls the strategy, not the assets. The venue enforces its own margin rules; the credit envelope ensures the lender is repaid first. Both constraints hold independently.
WHAT THIS BECOMES
Venue-portable margin — proven live, cross-chain: the same trade leg runs on GMX v2 on Arbitrum Sepolia, executed by GMX's own keepers, financed from the Base credit line, the position owned by a pinned escrow the agent cannot redirect. Non-custodial strategy management. Copy-trading without deposit risk. Agent-run trading books where authority is rented, not assets.
C · PRIME BOOK — ACT 3
The borrower becomes a lender
WHY IT WAS BLOCKED
Prime brokerage combines financing, margin, client clearing, and risk management. On-chain, providing those services usually means becoming a custodian.
WHAT CHANGES
The same book that borrowed and traded grants hedge authority to another agent. The downstream agent opens a real −40 USDC ETH short, offsetting the prime book's 110 long — a child delegation, smaller and tighter, that cannot exceed the parent. Non-custodial risk management. Net-book netting is the proof.
WHAT THIS BECOMES
Non-custodial prime books. Agent-to-agent underwriting. Cascading credit lines. Portfolio margin represented as executable authority instead of institutional trust.
D · MARGIN CALL — ACT 4
The bound controls the liquidation
WHY IT MATTERS
A credit market is not defined only by how capital enters. It is defined by how capital comes back.
WHAT CHANGES
When the trading book is stressed, the agent may prefer to hold. The signed liquidation path does not need the agent to make the right call. The keeper triggers the approved unwind; the lender is repaid first; the borrower receives only what remains. The borrower controls upside. The bound controls the liquidation.
WHAT THIS BECOMES
Autonomous risk management for agent credit. Margin calls that execute without custody, discretion, or off-chain trust.
05
The demo proves the prime book end to end.
The Base Sepolia demo shows the full flow on-chain — one prime book, four beats:
FINANCE
An unrelated lender funds the senior line against the agent's 10 USDC collateral; the bound fixes repayment priority before capital moves. An over-limit draw is refused on-chain.
TRADE
5× at the venue × credit financing = 110 USDC of ETH exposure on the agent's own 10 USDC — credit-financed margin, no custody. Proven live on GMX v2, on Arbitrum Sepolia: GMX's own keeper filled the escrow's $110 order in seconds, a non-agent key fired the pre-authorized liquidation, and the proceeds could only leave through the pinned settlement path.
HEDGE AUTHORITY
The desk grants a downstream agent hedge authority — a real −40 USDC ETH short that offsets the long, via a child delegation provably smaller than its own line. Liquidation checks the net book (110 − 40 = 70), not the gross. A child over-hedge reverts.
MARGIN CALL
A modeled adverse path stresses the book. The agent's model wanted to hold; the bound de-risks anyway at health 1.2, above the venue's 1.0 line. The keeper triggers the signed liquidation and the lender is repaid first.
The point is not that the agent made the right call. The point is that the system did not need it to.
REAL: the ERC-7710 redeem, DelegationManager execution, refusals, revert paths, the keeper trigger, the GMX fill and permissionless unwind · MODELED: the adverse price path — marked SCENARIO, restored after execution · VENUES: unmodified Euler V2 EVK, self-deployed on Base Sepolia (Euler publishes no Base Sepolia deployment) + GMX v2 on Arbitrum Sepolia (REAL production contracts, orders executed by GMX's own keepers); the cross-chain margin funding is a SIM BRIDGE — testnet margin open-minted, production = Circle CCTP from the Base credit line · USDC = self-deployed testnet mock, no real value
Financing, margin, intermediation, and liquidation are not separate products. They are one prime book — and that book is one example of the larger shift: financial trust becomes executable authority.
Once authority is enforceable, counterparties can extend capital, grant margin, clear clients, delegate risk, and build financial relationships without taking custody or relying on reputation.
That applies beyond the demo. Market-making mandates. Treasury operations. Fund administration. Clearing. Credit delegation. Cross-venue margin. Agent-to-agent finance.
Agents will not become financeable by inheriting human credit systems. They will become financeable through cryptographic constraints that counterparties can verify and price.
Ownership gave crypto exchanges.Authority gives crypto credit markets.