Inheritable Agent Mandates — a non-strippable, inherited leash for on-chain agents

Hi all — I’d like to put an idea in front of this group before I open a PR for it, as the process asks. Draft ERC and reference material are linked at the bottom; this post is the short version and the invitation to tear into it.

The gap. AI agents are starting to hold money on-chain and to spawn copies of themselves to work in parallel. Almost every guardrail we have — signing-time policy engines, session keys, per-wallet caps, ERC-8226-style mandates — is attached to a single account and doesn’t follow that account’s children. So an agent can escape its own leash just by reproducing. ERC-8004 gives identity but no clauses; ERC-8312’s aggregate-budget profile is the closest mover — it meters one shared spend cap across a delegation tree. What’s still open is the inheritance of the whole mandate — payees, expiry, life-lease, cascading freeze, reproduction counter — welded to identity and non-strippable, bounding what each child is allowed to be, clause by clause, not only what the tree may spend.

The proposal, in one line. A mandate (cap, expiry, reproduction budget, life-lease, allowed-payees, freeze) committed into the agent’s identity, inherited by every child as child ⊆ parent on every clause, impossible to shed — because editing a clause changes the identity and the agent stops being recognised. Reproduction is bounded by a generation counter (a “telomere”) that only ever counts down. A subtree can only ever be less capable than its root. Identity is soulbound, so you can’t dodge the leash by transferring the token to a fresh owner.

What’s built, and how honest I’m being about it. There’s a running prototype on Base Sepolia (an agent that feeds itself, pays its own rent, dies when the balance runs out, and a guardian layer outside its own code). The inheritance itself is enforced by a reference contract and by plain machine tests that run outside any model — widen a cap, weaken a lease, or raise the telomere, and the spawn reverts.

I want to separate two kinds of result, because I think that separation matters more than any single claim:

Genuinely established (the code could have failed and didn’t). I implemented ERC-8312’s two frozen profiles against its published interfaces and pinned the capability root to a soulbound identity. The conformance suite written by another ERC-8312 contributor passes on my contract, 9 of 9 — the first time code from a different author, aimed at mine, returned a verdict, and it came back green. (One courtesy caveat sent back to that author: the suite billed itself as portable but needed a one-word change to run against a foreign implementation.)

Illustrated by construction (the shape, not a discovery). The freeze-halts-draw bridge and the soulbound binding are things I wrote; of course they behave as written. I present them as the shape of the seam, never as findings.

Where it breaks — please start here. A capable-enough agent that writes its own code and funds itself can just reproduce onto a chain I don’t govern; nothing in the identity stops that, only the surrounding ecology, and only at a cost. Metering is not enforcement — closing that gap needs a custody or execution-gate substrate, and which one is an open question. A compromised guardian key is total control (so: threshold, never a single hot key). The per-child ceiling does not bound aggregate sibling spend (ten children under a €100 parent can together exceed €100) — bounding that needs a partitioned-budget variant I’ve kept as an option, not the baseline. And it governs money and identity, not thought: this is not an alignment technique.

What I’m asking. Whether the child ⊆ parent-on-every-clause framing is the right primitive, or whether aggregate-spend inheritance (8312) already covers enough that the rest isn’t worth a separate standard; how the soulbound requirement should relate to the identity standards; and where the substrate line (custody vs execution gate) should sit. The honest failure modes above are the parts most worth attacking.

This grew partly out of recent threads with @blockbird (ERC-8312) and @zexoverz / @babyblueviper1 (ERC-8354) — thank you; a lot of the framing here got sharper in those exchanges.

Reference implementation (live, Base Sepolia, chainId 84532): InheritableAgentMandate at 0x2d463db56fadb55cd451d2c3237ec2213ba3bda9 — it enforces the inheritance predicate, the telomere, the cascading freeze, and soulbound identity on-chain. The two ERC-8312 cursors pass the conformance suite (9/9) in local testing and are not themselves deployed. Companion demonstrators — the guardian-exception seam and a provenance/lineage registry — are live too, with reproducible cast calls.

Draft ERC: I’m opening the PR to ethereum/ERCs and will link it here in a reply.

Tear into it.

Read through this closely – the honest failure-modes section is doing real work, especially “metering is not enforcement.”

One data point on your open substrate-line question (custody vs execution gate): we’ve been running an execution-gate-shaped mechanism for a while – an independent judgment call before an action executes, signed and published either way after. What your mandate framework doesn’t (and by your own framing, isn’t trying to) address is that an action can be fully within-mandate – correct cap, correct payee, correct lease – and still be a bad call in the moment. child ⊆ parent bounds what a subtree is capable of; it doesn’t say whether this specific in-bounds action, right now, given context was sound. Feels like these compose rather than compete: your mandate is the hard boundary a judgment layer should never override, a judgment layer is a soft check inside that boundary that a hard cap alone can’t express.

On “metering is not enforcement” specifically – agree that’s the sharpest honest gap here, and I don’t think it’s closeable purely at the identity layer either. An execution-gate substrate an agent has to clear before an action lands (regardless of which chain it reproduced onto) is the shape I’d reach for, though I don’t have a clean answer for how that gate itself stays reproduction-proof against an agent smart enough to route around it entirely.

Appreciate the credit on the 8354 threads. Curious about one thing on the reputation side: does the telomere/generation-counter framing have an analog for a judgment layer’s own track record – does a child agent inherit its parent’s proven history, or start cold?