Research

Protocol Design Document

A structured web adaptation of MANDATE.pdf — the long-term protocol research document. This covers the vision beyond the current MVP. For what actually runs today, see the Product Overview and Documentation.

About this page

Protocol vision

One-line thesis: everyone is building either private execution, encrypted mempools, agent wallets with plaintext policy engines, or intent/solver networks. Nobody has built the thing that connects them: a layer where an autonomous agent can trade a hidden strategy over a hidden portfolio while producing public, succinct, composable proofs that every action complied with a pre-committed risk mandate — and where those proofs accumulate into a portable, privacy-preserving reputation that lets strangers delegate capital to agents they cannot inspect.

The document is explicit that MANDATE is deliberately not a new L1. It is proposed as cryptographic middleware plus an app-specific settlement layer anchored to Ethereum — contracts, circuits, and a thin operator network, not a new chain competing for validators and liquidity from zero. Research The working MVP implements a small slice of this vision on a local Anvil chain, described throughout as MVP.

The full vision names four gaps the research identifies as unsolved elsewhere:

1. The delegation-trust gap— no system today lets a stranger cryptographically verify an agent's track record (limits respected, drawdown bounded) without trusting the operator, the model, or the cloud it runs on.
2. Portfolio-state-conditioned policies— enforcing stateful risk limits (drawdown, leverage) requires the enforcement layer to know the portfolio, but publishing the portfolio destroys the agent's privacy.
3. Reputation portability — agent reputation today is a token price, a follower count, or a platform-local score; nothing compresses verified behavioral history into a portable, privacy-preserving credential.
4. Interoperability of trust, not just messages — ERC-7683 standardized intentmessages, but nobody standardized a proof-carrying answer to “is this agent allowed to sign this, and is it in good standing?”

Design principles

Competitive landscape

The document surveys general-purpose base layers (Bitcoin, Ethereum, Solana, Avalanche, Cosmos, Polkadot, Near, Aptos/Sui), modular infrastructure (Celestia, EigenLayer, shared sequencers), privacy systems (Zcash, Monero, Aztec, Aleo, Secret Network, Starknet, Penumbra), and the direct competitive frontier — MEV, intents, and agent infrastructure. A few comparisons it draws out explicitly:

Cryptographic architecture

The research document specifies a fuller cryptographic stack than the current MVP implements:

The three concentric privacy rings the design proposes:

• Ring 1 — transit privacy: intents encrypted under threshold IBE until the epoch's intent set is fixed. Research (MVP: commit–reveal via a trusted sequencer, MVP).
• Ring 2 — state privacy: portfolio state as Poseidon commitments in a tree, updated by verified fill-delta proofs. MVP (implemented, without the fill-delta proof step).
• Ring 3 — behavioral privacy: uniform-price batches mean an individual fill can't be attributed to an individual agent from the public transcript. MVP for the demo's single market.

Agentic trading flow (end-to-end vision)

The document walks through a ten-step full-vision flow: principal setup and mandate definition, agent registration, continuous authorization proof via session signatures, off-chain strategy execution, compliance proving, encrypted submission, batch clearing, an optional ERC-7683 cross-chain leg, state updates, and — after months of epochs — a folded reputation credential a vault on another chain can verify in one proof and act on, without the agent ever revealing a trade.

The MVP demonstrates the middle of this flow — registration through compliance proving, submission, and settlement against a single local market — without cross-chain execution or folded reputation.

MANDATE Lite — the buildable MVP

The document specifies a scoped, four-week “MANDATE Lite” build target, explicit about what should be real versus simulated:

This is a rare case where the shipped MVP tracks the document's own scoping almost exactly — the “what is real vs. simulated” table in the repository README uses nearly identical language to this section of the protocol design.

Risks

The document is unusually direct about what could fail. Three risks it flags as possibly fatal:

1. Cold-start liquidity— batch auctions need flow to price well; agents need pricing to bring flow. The document names this “the real boss fight, not cryptography.”
2. Reputation may not be the commodity it claims — allocators might keep allocating on brand and audited track records rather than zero-knowledge credentials. A market hypothesis, not a theorem.
3. Statistical privacy erosion is permanent and cumulative — clearing prices, volumes, and participation timing leak bits every epoch, forever; strategy privacy degrades to strategy obscurity against a motivated long-horizon observer.

It also flags regulatory exposure directly: this is, functionally, dark-pool infrastructure for autonomous traders, and the document recommends building selective-disclosure tooling from day one rather than marketing anonymity.

Future roadmap

The research document's own phased plan for a serious 12–24 month build (distinct from the product roadmap on the Product Overview page):

Final recommendation

The document's own conclusion: build MANDATE as cryptographic middleware and an app-specific settlement layer on Ethereum rollups — not a new chain, and not yet its own rollup. Ship MANDATE Lite first as a hackathon-scale proof of the one genuinely novel claim (the policy circuit), then write the fuller protocol paper with the risk section intact, then publish the policy-circuit and credential format as a draft standard early — in this design, the standard is the moat.