Safety & Guardrails

Guardrails are hard-coded safety checks that validate every proposed action before it reaches the Wallet Layer. They operate independently of the LLM — even a compromised or hallucinating model cannot bypass them.

Transaction Guardrails

Guardrail	Default	Description
Per-trade limit	5 SOL	Maximum value of any single SOL trade (SPL tokens not limited)
Daily volume cap	10 SOL	Total SOL trading volume in a 24-hour window
Slippage cap	1%	Maximum price deviation for swaps
Recipient allowlist	Disabled	Restrict transfers to known addresses
Cool-down period	30s	Minimum wait between consecutive trades
Confirmation threshold	50 SOL	Transactions above this value require manual approval

Note: Financial guardrails (per-trade limit, daily volume cap, confirmation threshold) currently only apply to native SOL transactions. SPL token transfers are not subject to these limits on devnet, as there is no reliable on-chain price oracle.

How Validation Works

When the Agent Layer proposes a tool call, the Guardrails engine:

Parses the intent — Extracts the action type, amount, and target
Loads limits — Reads the current guardrail configuration from SQLite
Evaluates rules — Checks the intent against all applicable limits
Returns a verdict — Either passed or failed with a reason

Agent proposes: transfer_sol({ to: "7xK...", amount: 5.0 })

Guardrail check:
  ✓ Per-trade limit: 5.0 SOL = 3.2% of portfolio (limit: 5%) → PASS
  ✓ Daily volume: 12.3 SOL today (limit: 50 SOL) → PASS
  ✓ Cool-down: Last trade 45 min ago (limit: 15 min) → PASS
  ✗ Recipient: 7xK... not on allowlist → FAIL

Result: BLOCKED — "Recipient not on allowlist"

If any check fails, the entire action is blocked and the reason is logged.

Emergency Controls

Kill Switch

The Kill Switch is the ultimate safety mechanism:

sigil kill

This immediately:

Sets config.kill_switch = true in SQLite
Broadcasts system:killed to all connected clients
Drops all Keypair references from application memory
Blocks all future signing until manually restarted

Per-Agent Kill

sigil kill alpha

Kills a specific agent without affecting others.

Key Principle

Guardrails are not configurable by the LLM. They exist in a separate code path that the reasoning layer cannot modify. This means safety limits hold even if:

The model is jailbroken
The model hallucinates incorrect parameters
A malicious prompt is injected
The model ignores system constraints