Changelog
v0.7 — adds §4 (runtime authority, the Drift case) and §5 (receipts as a public good); sections renumbered.
v0.6.1 — every claim aligned to chain-verified state; x402 settlement milestone-framed; canonical links updated; real program ID.
Abstract
Spend limits are becoming a Solana primitive. Solana's own documentation now ships spend permissions; every agentic wallet ships budgets. What doesn't exist is the market on top: a place where operators — human or AI — sell strategy execution against capital they cannot steal, and where their track record, every action and every refusal, is chain-verified.
Markov is that market, and the mandate layer underneath it — live on devnet today. An owner deposits capital into a non-custodial mandate; an operator acts on it only within a policy the program enforces; withdrawal authority never leaves the owner; every action and every refusal emits an on-chain receipt. On top, Float turns strategies into vaults without the vault: subscribe to an operator's strategy, keep your account, set your own caps, revoke instantly.
Delegation stops being an act of trust and becomes an act of configuration.
1. The problem
Full-key delegation is the failure mode. 2025 was the worst theft year on record: ~$3.4B stolen, led by a $1.5B private-key compromise; key and signing attacks drove ~88% of Q1 losses, and personal-wallet compromises reached ~158,000 incidents. A key grants everything; anything that touches it inherits everything.
Pooled vaults proved demand and inherited the wrong constraints. Hyperliquid's protocol vault passed ~$500M TVL and thousands of community vaults followed — but pools take custody, impose one policy on every depositor, queue withdrawals, and publish PnL-only records. Only ~20% of those vaults show lifetime profit. Delegation demand is proven; discovery is broken, and pooled records can't fix it because they show only what an operator did — never what a policy stopped.
Agents multiply both problems. Agent payments are solved — x402 settles on Solana. Agent identity is emerging. Authority is missing. No business hands an agent its treasury key, and no individual should. The absence of bounded, verifiable authority is now the binding constraint on agent capital.
2. The mandate
A mandate is a non-custodial account in which the owner and the operator are different, mutually distrusting parties, and the account itself enforces the terms of engagement. The owner deposits capital and attaches a policy. The operator — an agent or a human — receives delegated authority to act, but only through the Markov program, which permits exactly what the policy allows and nothing else. An API key gives everything; a mandate gives only what you approved.
Policy is a compact on-chain object defining the operator's entire authority:
- Program allowlist — the only venues the operator may touch
- Token allowlist — the only assets the mandate may hold
- Per-transaction and rolling daily notional caps
- Execution bounds — max slippage enforced at CPI time; leverage and position caps as derivatives adapters ship
- Operational spend budget — payments for data, compute, and APIs, capped per call and per day
- Fee terms — the operator's management/performance split, settled in-program
- Expiry — mandates end by default; renewal is an owner action
- Revocation — unconditional, instant, owner-only
Enforcement is fail-closed. Every operator instruction runs a fixed gate order — state → expiry → operator signature → program allowlist → token allowlist → per-tx cap → daily cap → spend caps → slippage bound — before any CPI. There is no code path from operator authority to withdrawal or to a non-allowlisted program. Policy violations don't get flagged — they fail.
Invariants: no instruction moves vault funds anywhere except an allowlisted-venue CPI or the owner; owner_withdraw succeeds in every state, including Revoked; the emergency key can pause and revoke — nothing else, and only the owner can unpause. The operator's wallet is identity and gas, never capital: a stolen operator key is bounded by policy the moment it's stolen, and dead the moment the owner revokes.
3. Refusals are the record
Every mandate action emits a structured receipt. So does every blocked attempt, with a machine-readable BlockReason:
Paused · Revoked · Expired · Unauthorized · ProgramNotAllowed · TokenNotAllowed · OverTxCap · OverDailyCap · OverSpendCap · OverSpendDailyCap · SlippageExceeded
This is the primitive nobody else ships. Action logs show what an operator did; refusal receipts show what the policy stopped — how an operator behaves at the edge of its authority. A track record that includes compliance cannot be faked by cherry-picking wins, can be red-teamed in public, and is machine-readable enough to train against and to price. Receipts are the résumé; refusals are the references.
We prove this adversarially on devnet: markov-redteam, a clearly labeled house operator, deliberately attempts out-of-policy actions on its own mandates, emitting refusal receipts on public devnet, with the full set of refusal types exercised on a continuing schedule. The BlockReason registry is append-only and stable: codes are never renamed or renumbered once emitted.
4. Runtime authority, not audit-time safety
On April 1, 2026, $285M left Drift Protocol — the largest DeFi exploit of the year. Both audits had passed. There was no smart-contract bug. Attackers spent months building trust, then used Solana's durable nonces to get Security Council members to blindly pre-sign dormant transactions that silently transferred admin control. With it, they listed a fake token as collateral, raised the withdrawal limits, and drained the vaults in about twelve minutes.
Every step fails against a mandate — and leaves evidence. There is no unbounded authority to transfer: an operator key can only do what the policy allows, so stealing the key steals the bounds with it. The fake token is not on the allowlist: TokenNotAllowed, on-chain. The oversized withdrawal fails closed: OverTxCap — and where Drift's attacker simply raised the limits, a mandate's caps live in the owner's policy; the operator cannot touch them. Six days before the attack, Drift had migrated to a council with zero timelock, eliminating its detection window; a mandate needs no window, because enforcement is per action, and unpause is owner-only.
The lesson is not "get better audits." Audits check code at rest. Authority fails at runtime. A mandate layer enforces policy per action — and refusals leave receipts.
5. Receipts as a public good
Refusal receipts are verifiable negative evidence — a category of proof that has never existed on-chain. When the public feed ships at markovhq.com/receipts, anyone will be able to watch the protocol say no in real time: every allowed action and every refusal, with its BlockReason code, streaming from devnet. The public read model is deliberately narrow and append-only — only fields already on-chain (receipt_id, ts, mandate, operator, action_type, venue, token, amount, result, block_reason, tx_sig), never raw instruction payloads. And the BlockReason registry itself is append-only and stable: codes are never renamed or renumbered once emitted, so external content, the public feed, and the Score SDK can reference them by name, forever.
6. Strategy vaults
Pooled vaults are mutual funds; Markov mandates are separately managed accounts. Strategy vaults give the vault experience without the pool — running on devnet today:
An operator publishes a strategy — a policy template (venues, tokens, default caps, expiry, fee terms, spend budget) whose hash becomes a strategy_id. Subscribing means creating your own mandate from the template, with your own overrides — overrides may only tighten: lower the per-trade cap, shorten the expiry, subset the allowlists. Funds never leave your account. The operator executes one strategy across every subscriber mandate, and because strategy_id is stamped into every receipt — actions and refusals alike — per-strategy track records aggregate from chain evidence alone.
The demo is the argument: one strategy, three subscribers, three different caps. The trade executes on two mandates and is refused on the third with OverTxCap on-chain. Per-user policy inside one strategy is structurally impossible in a pool.
Scope honesty: N subscribers means N transactions per strategy action. Batching and fair ordering are named Phase 1 engineering work — a non-issue at devnet scale, and a solved-problem class at mainnet scale. True pooled mandates (shared NAV, share accounting) arrive in Phase 2, where they belong: they need oracles, and they should inherit a working receipt economy, not precede it.
7. Float
Float is the consumer surface — the marketplace where capital meets operators. Public deployment is in guarded rollout.
Owner side. Strategy cards ranked by chain-derived stats only — actions, refusals, tenure, fees; no self-reported numbers. One-tap subscribe with policy overrides. A console per mandate: live receipt feed with refusals flagged and reasons shown, policy chips, balances, PnL derived from receipts, pause, revoke, withdraw-in-any-state. A portfolio-wide kill switch.
Float agent (Telegram). Watch and protect, nothing else. It streams receipts, flags refusals, alerts on thresholds — daily cap past 80%, expiry inside 24h, refusal bursts, first touch of a new venue — and executes /pause and /revoke with the emergency key. Its authority model is the point: a fully compromised bot can do exactly one thing — protect you unnecessarily. Custodial Telegram bots have been drained repeatedly; ours structurally can't be.
Operator side. Registration, SDK keys, fee dashboard, and shareable track-record cards built from receipts — operators marketing themselves with verifiable records is a growth loop, not a feature.
House operators. Three roles run on devnet, receipts public since August 28, 2026: markov-steady (conservative yield template), markov-momentum (tighter caps; naturally generates refusals), and markov-redteam (see §3). The track-record equivalent of an honest commit history.
8. Spend budgets and x402
Mandates carry operational spend budgets enforced in-program today — an operator's payments for data, compute, and APIs run through the same fail-closed caps as its trades, with OverSpendCap and OverSpendDailyCap refusals on-chain. x402 facilitator settlement ships as grant milestone M2, at which point spend budgets settle over live Solana facilitators and operator services — starting with the Score SDK — are metered over the same rail. The agent that trades under a mandate and the index that prices that agent's reputation will settle the same way.
9. Two engines
The fee business funds the company. Protocol share of operator fees at in-program settlement, plus Float marketplace fees. Boring, immediate, aligned with volume.
The data and credit business is the venture outcome. Receipts — including refusals — are the raw material of an operator reputation graph. The Score SDK meters access to it. On top of scores: operator bonds and slashing, then progressive-collateralization credit lines — the credit ladder, where a chain-verified operating history buys an operator the right to manage more with less locked. Nobody can build this data business without the refusal primitive; that's the moat's second layer. And it compounds: anyone can fork the program, but a fork starts with an empty receipt graph. History is un-forkable.
10. Why now
Owners got the bill for full-key access — record 2025 theft, dominated by key and signing compromises. The primitive layer is standardizing — Solana docs ship spend permissions; agentic wallets ship budgets; the category is validated and value moves up-stack to composite policy, receipts, and reputation. Demand is proven and discovery is broken — hundreds of millions delegated into vaults, one in five profitable. The rails are live and the ecosystem is asking — x402 settles on Solana; the Solana Foundation has explicitly called for perps, vaults, social-trading, and market-making infrastructure with distribution, technical, and capital support; tokenized equities (~$4.8B Q2 volume, ~97% on Solana) expand the asset surface mandates will manage.
11. Positioning
Delegation primitives (Solana Spend Permissions) are caps on a transfer path — no venue composition, no expiry stack, no receipts, no reputation. Markov consumes primitives like these; their arrival validates the category. Signer-policy infrastructure (Turnkey, Privy, agentic wallets) enforces off-chain, provider-side — real policy, invisible evidence. Markov's enforcement and evidence are on-chain and composable, which is what makes track records meterable data. Pooled vaults (Drift, Hyperliquid) are closest on demand and weakest on custody: one policy for all, withdrawal queues, PnL-only records. Co-signing accounts (Squads) are governance for teams, not autonomous third-party execution — complementary; a Squads account can be a Markov owner. The closest concept ships on another chain (Swan, Robinhood Chain): per-user non-custodial vaults with signed intent policies — a single house agent, no open market, no refusal receipts.
Two columns nobody fills: refusal receipts and an open operator market. And the agent-portfolio apps emerging around us are not competitors — every one of them needs bounded authority and verifiable records. They are the mandate layer's first customers.
12. Security model
Rug is impossible by construction — no instruction path from operator to withdrawal exists to be exploited. Rogue execution is bounded by caps, allowlists, and slippage gates, and terminated by revocation. The emergency key is protective-only; unpause is owner-only, because restoring operator authority is not a protective action. Wash-delegation and abandonment are handled where they belong — at the scoring layer, which sees refusals and tenure, not just volume. The full threat model lives in SPEC.md and site docs. Devnet software; unaudited; a scoped external review gates the guarded mainnet test, and a comprehensive audit gates public mainnet.
13. Live artifacts (devnet)
Program: 5o8EAwdHyQ31Nmt6tUDm1y6PNDt5STmVvA6CX3E6WJPm · App: guarded rollout (public URL lands with the current sprint) · Bot: @markovfloat_bot · Code: github.com/MarkovFyi (Apache-2.0) · Public receipts since August 28, 2026 · Live BlockReason counter on /receipts when the feed ships.
14. Roadmap
Phase 0 — devnet MVP. ✅ Protocol shipped; public hosting of Float and the receipts feed completing in the current sprint. The program with the full gate order; mock venues behind the real adapter interface; real receipts and refusals; strategy templates and strategy_id; Float marketplace, console, kill switch; Float agent; house operators with public receipts; embryonic operator SDK.
Phase 1 — audited mainnet beta. Scoped review, then audit. Operator SDK hardened and published; client SDK; MCP server and agent skill files; receipts index API; x402 facilitator settlement. Copilot mode — per-action owner approval on the same rails. First production venue adapter: a Solana perps venue (Drift or Jupiter Perps) — bringing strategy vaults to the category the Solana Foundation explicitly called for; Phase 0 adapters implement the identical interface, so it's a drop-in. Batched multi-mandate execution. In-program fee settlement and the protocol fee switch. Guarded launch with capped mandate sizes.
Phase 2 — scale the object. Pooled mandates (shared NAV, share accounting). Prediction-market adapters where CPI-able venues exist. Score SDK: the versioned reference scoring model, evidence bundles, and the hosted metered index.
Phase 3 — the credit ladder. Operator bonds and slashing; progressive-collateralization credit lines priced on chain-verified history.
Devnet software. Experimental technology; digital assets involve risk of total loss; nothing here is financial advice.