Building Risk-Aware AI Agents for Vault Curation

Agents are becoming a core part of our offchain intelligence stack. Their role will grow as they earn it: first as tools, then as delegates with scoped onchain permissions, eventually as orchestrators executing human-set goals.

Institutional capital is moving onchain, and it expects the operational standards it gets everywhere else: continuous monitoring, disciplined execution, and accountability for every decision. Vault curation has to deliver those standards around the clock, across dozens of markets and chains, in an environment that never closes. That is fundamentally an intelligence problem, and it is why Gauntlet has spent years building offchain systems that watch, model, and act on onchain markets.

Over the past year, AI agents have become a key part of that stack. This post lays out how we think about their role: what they do for our curation teams today, why humans remain the gate on every decision that matters, and how we expect agent responsibility to expand as the infrastructure to constrain them matures.

Curation is an adversarial optimization problem

From the outside, curation can look like a periodic allocation choice. Underneath, it is a live optimization problem in an adversarial environment. Inputs have to be cleaned before they can be trusted. Data has to be fresh, because markets reprice in minutes and stale state is worse than no state. Flows have to be classified, since a supply spike can be organic demand or the first leg of an attack, and the correct response to each is different. And every market needs models for assessing risk: liquidity depth, collateral quality, oracle behavior, counterparty exposure.

Data integrity is the hardest of these requirements. Any single price feed can be wrong, thin, or stale, and acting on a bad reading costs as much as missing a real event. When a stablecoin trades under its peg on one venue, the question is whether the peg broke or the feed did, and that has to be settled in the same minutes the market is moving. Every input worth acting on is checked against as many independent sources as we can reach, as fast as we can reach them, with disagreement between them treated as its own signal.

Our intelligence stack exists to answer these questions just in time, at the moment a decision has to be made. Any agent operating in this environment inherits the same requirements. A general-purpose model with a stale view of DeFi does not meet them, which is why we build our own.

Why humans still gate curation

Given capable agents, it is tempting to conclude that curation should be automated end to end. The structure of the problem argues otherwise.

First, no single actor should be able to move capital unilaterally. Multiple signers on every consequential action is a risk control we apply to people, and we apply it equally to agents.

Second, regime changes in crypto are sharp. Volatility is not evenly distributed: an oracle failure or a security incident can flip a market from in-distribution to out-of-distribution in a single block. Models trained on calm conditions overfit them, and the moments they miss are precisely the moments that matter most. Recent stress periods have made that lesson concrete for the whole industry.

Third, some inputs are not onchain at all. Real-world asset collateral carries credit risk that lives in legal documents, servicing arrangements, and off-chain balance sheets. Assessing it is analyst work, and it stays that way.

Finally, curation is a worst-case problem, not an average-case one. In most software domains you can A/B test your way to improvement, because a bad variant costs you a conversion rate. In curation, an error costs supplied capital. There is no acceptable experimentation budget, which means agent behavior has to be scoped in advance and hallucination is not a tolerable failure mode. It has to be engineered out of the set of possible actions, not merely discouraged.

Aggregate strategies raise the bar further

Aggregation strategies that enable more efficient allocation, such as ones we run on Aera vaults, compound difficulty as they run across multiple vaults, venues, and chains. Every position has its own behavior, and the interactions between them create a second layer of questions: how a bridge delay propagates into a rebalance, how one vault's liquidity assumptions depend on another's, how a newly deployed oracle behaves under load. Historical data is often silent here, because the specific combination may never have existed before. The only way to answer is to reason about the structure and measure it fresh.

Why we built our own agentic harness

Our mandate is to manage risk on more than $1.5 billion in supplied assets, optimizing for the worst case rather than the average case. That leaves very little tolerance for variance in how an agent behaves, so the guardrails, approval gates, and audit logs have to live at the infrastructure level, where the model literally cannot reach them.

Building on a vendor harness, ChatGPT or Claude or anything similar, means depending on someone else's infrastructure for exactly those controls, and none of it gives us locally verifiable control over what an agent does. Ownership of the controls and verifiability of the actions they govern are the two things we cannot outsource.

So we built our own harness. Aria, the in-house agent we stood up in the first quarter of 2026, runs on a harness native to our offchain and onchain infrastructure: the Hermes agent as its runtime, with most of the components around it replaced or added. Owning that layer is also what keeps secrets and signing keys inside an enclave and out of a model's context, turns support for a new chain or protocol into an integration we ship on our own schedule, and lets Aria reach the company through different surfaces, a Slackbot for everyday questions and lower-level access for engineering work, each with its own permissions.

Agents as tools, humans as the gate

DeFi competence itself had to be engineered. The domain evolves faster than any training corpus, and knowledge baked into model weights goes stale within months, so the agent works from a structured, continuously maintained knowledge base and treats onchain state as the ultimate source of truth. On top of that grounding sit purpose-built tools for risk work, from alert triage to simulation against forked mainnet state. And the whole system runs inside guardrails enforced at the infrastructure level, beyond a model's reach: agent-initiated changes to any production system take effect only after one to two human approvals, the same risk-management standard we apply to everything Gauntlet ships.

Today Aria triages risk alerts across our vault footprint, covering price and peg drift, utilization spikes, and liquidation proximity. It distinguishes self-recovering conditions from ones that need escalation, posts its analysis, drafts and reviews code, and assists with research, vault deployments, and documentation. Since launch that has meant over 450 production alerts triaged, more than 200 pull requests reviewed, and 61 pull requests merged after human approval. The practical effect is that our curation capacity scales with the number of markets we cover rather than with headcount, while every consequential decision still lands on a human desk.

Medium term: autonomy inside scoped sandboxes

Expanding an agent's role safely means shrinking the space in which it has to be trusted. Aera's architecture makes this concrete: guardian permissions are cryptographically scoped via merkle root, so an agent operating as a guardian simply cannot act outside the set of actions authorized by the vault’s (human) owner. 

This changes the question a curator has to answer, from "do we trust this agent?" to "what exact action set has this agent earned?" 

Scopes can start narrow, a single rebalance type on a single vault, and expand with demonstrated performance and diligence. Getting there still has open problems: verifying agent reasoning before execution, modeling cross-protocol interactions inside a sandbox, and evaluating performance rigorously in a domain where live experimentation is off the table. These are the problems we are working on now, and they are tractable precisely because the permission layer already exists in production.

Long term: agents orchestrate, humans direct

Further out, we see agents acting as orchestrators: coordinating monitoring, analysis, and execution across chains and strategies, within goals and risk policies that humans set and remain accountable for. In that world, human attention concentrates where judgment is irreplaceable: on risk policy, on out-of-distribution events, on the credit and counterparty questions that never were onchain. Agents carry the operational load underneath, strategies scale without execution bottlenecks, and the risk profile holds because the system was built to hold it.

None of this makes curation easy, and none of it removes the human element. It moves it to where it belongs: on direction and policy rather than on every operational step.

Intelligence offchain, verification onchain

We expect agentic curation, wherever it is built, to settle into this division of labor: judgment running offchain, where it can draw on whatever data and compute the problem demands, and authority defined onchain, where contracts enforce it and anyone can audit it. The two need each other, because unconstrained reasoning is unsafe to deploy and constraints without intelligence have nothing to govern. Our approach is to build each side to the standard the other assumes. 

On the offchain side, Aria, our custom agentic layer, reasons over live onchain state, works with purpose-built risk tools, and hands every consequential action to a human before it takes effect. 

On the onchain side, Aera makes delegation precise: agents act as guardians, their permitted actions committed to a merkle root, down to the individual function call.

That loop, offchain judgment constrained by onchain verification and gated by humans, is how we intend to scale curation to the size the market is heading toward. The agents will keep earning wider scopes. The standard they have to meet will stay the same.