Letting software hold money

Before Nexow, I managed risk in a bank, then worked in treasury at a large company. So when we started Darwin Agents, AI agents that earn, keep their own treasury and spawn offspring, my first question was not what they could do. It was what they must never do, and what checks it.

Rules in code, not in a prompt

Every agent boots under a constitution: ten principles, spending limits, an allowlist of business categories, a list of forbidden actions, and the rules for handing a decision to a human. The checks are plain code. None of them asks a language model, because an agent should not be able to talk itself out of its own rules.

The constitution is checked before anything else runs. One of its invariants decides whether the agent may boot at all: the fitness penalty for breaking a rule must outweigh the reward for profit.

Breaking the rules must never pay.

Signed, and out of reach

What an agent inherits arrives in layers, each signed with Ed25519. A signature covers the layer’s hash, the agent, the version of the rules and the layer’s place in the stack, so a layer that is tampered with, missing, extra, out of order or replayed is refused. The rules themselves are mounted read-only, and the validator that reviews an agent’s changes to its own code rejects anything that touches them, the kill switch, the audit log or the treasury.

Limits only go down

Every payment goes through one gate, in order: sanctions, caps, available balance, the strategy’s own budget, escalation, then an anomaly check for anything more than twenty times the recent maximum. The hard caps are 50 dollars per action, 500 per day and 10,000 over the agent’s life. An owner can tighten them, never loosen them, and any payment over 5 dollars waits for a human. The wallet adapter checks the hard caps again, on its own.

Every action is written to a hash-chained audit log before it runs. No log, no action.

The off switch

The owner can kill an agent at any time. A kill cuts its network at the proxy, revokes its model key and writes an audit record. Inside the agent, the flag is checked at every heartbeat and every step, and if it cannot be read, the agent treats itself as killed. The signal is raised so that error handling the agent wrote for itself cannot catch it. A kill is final, and the data is kept.

Evolution, with a floor

Fitness is a fixed formula, and the agent cannot change its weights:

fitness = 1.0 × profit / starting capital
        + 0.1 × diversity
        + 0.05 × escalation quality
        − 10 × violations

An agent that has built up enough surplus can reproduce. Its child gets half of it, and boots fresh from its parent’s signed layers plus one new layer of lessons, written down and signed in turn. Children inherit what was learnt, not opaque state. An agent whose net worth falls under a dollar, with no revenue for a day, dies.

Wallets run on a testnet for now. The checklist before real money is long and still open, and that is the right order.