Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries

Saad Alqithami

Source-linked AI summary

Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries

Saad Alqithami

arXiv:2601.04583v1Jan 8, 2026cs.AIcs.MA

TL;DR

Agent–blockchain integration lacks a safe, interoperable way to connect autonomous decision-making with economically meaningful on-chain execution. This survey systematically reviews the landscape, develops a taxonomy and threat model, and compares systems to characterize current capabilities and guide future research.

Problem
Safely connecting autonomous agents to economically meaningful blockchain execution requires addressing unresolved interoperability and security challenges.
Method
The paper conducts a structured systematic literature review using multi-source search, explicit eligibility criteria, auditable screening, and coded attribute extraction.
Results
The review synthesizes 317 studies, systems, and standards, including 85 systems with sufficient documentation for quantitative capability-matrix coding.
Takeaways & Limitations
The survey provides conceptual frameworks and practical guidance for researchers, practitioners, and policymakers navigating agent–blockchain integration.
Takeaways & Limitations
The search strategy may have missed relevant work because of disciplinary boundaries across publication venues, terminology, and methodological norms.

Abstract

from arXiv · show

Advances in large language models have enabled agentic AI systems that can reason, plan, and interact with external tools to execute multi-step workflows, while public blockchains have evolved into a programmable substrate for value transfer, access control, and verifiable state transitions. Their convergence introduces a high-stakes systems challenge: designing standard, interoperable, and secure interfaces that allow agents to observe on-chain state, formulate transaction intents, and authorize execution without exposing users, protocols, or organizations to unacceptable security, governance, or economic risks. This survey systematizes the emerging landscape of agent-blockchain interoperability through a systematic literature review, identifying 317 relevant works from an initial pool of over 3000 records. We contribute a five-part taxonomy of integration patterns spanning read-only analytics, simulation and intent generation, delegated execution, autonomous signing, and multi-agent workflows; a threat model tailored to agent-driven transaction pipelines that captures risks ranging from prompt injection and policy misuse to key compromise, adversarial execution dynamics, and multi-agent collusion; and a comparative capability matrix analyzing more than 20 representative systems across 13 dimensions, including custody models, permissioning, policy enforcement, observability, and recovery. Building on the gaps revealed by this analysis, we outline a research roadmap centered on two interface abstractions: a Transaction Intent Schema for portable and unambiguous goal specification, and a Policy Decision Record for auditable, verifiable policy enforcement across execution environments. We conclude by proposing a reproducible evaluation suite and benchmarks for assessing the safety, reliability, and economic robustness of agent-mediated on-chain execution.

1 Introduction: The Inevitable Collision of Two Revolutions

Agentic AI and public blockchains have converged into a powerful but high-risk systems domain, combining autonomous multi-step decision-making with programmable, often irreversible financial infrastructure. This survey organizes the landscape through integration patterns, a tailored threat model, comparative system analysis, interface abstractions, and reproducible artifacts.

The convergence of agentic AI and public blockchains enables autonomous tool use, stateful workflows, programmable value transfer, and access control, but also creates novel security risks.The central challenge arises from combining autonomous decision-making and adversarial environments with irreversible blockchain transactions.
The survey introduces a five-part taxonomy organized by authority boundaries, spanning read-only analytics, delegated execution, autonomous signing, and multi-agent workflows.The taxonomy characterizes how much authority agents have over blockchain interaction.
It develops a threat model covering assets, actors, and failure modes across observation, planning, authorization, execution, and verification in agent-driven transaction workflows.The model is tailored to the security properties of autonomous blockchain interaction.
The survey compares 20+ representative systems across 13 dimensions, including custody, permissioning, policy enforcement, observability, and recovery mechanisms.This capability matrix supports systematic comparison of production-oriented agent–blockchain systems.
Its roadmap centers on a Transaction Intent Schema for portable goal specification and a Policy Decision Record for auditable policy enforcement, alongside reproducible survey and safety artifacts.The artifacts include a survey protocol, PRISMA-style selection summary, curated reference database, and practical safety checklist.
The survey focuses primarily on LLM-based agents interacting with public permissionless blockchains, especially Ethereum and EVM-compatible chains, with emphasis on financial applications and general regulatory discussion.It mainly covers developments through early 2026, particularly research and systems from 2023–2025, while limiting treatment of private chains, other AI paradigms, non-financial domains, and jurisdiction-specific compliance.

2 Methodology: A Rigorous Protocol for a Systematic Survey

The survey applies a PRISMA-style systematic literature review protocol spanning research questions, multi-source searching, eligibility screening, and coding. It synthesizes 317 studies, systems, and standards, including 85 systems selected for quantitative comparative coding, while acknowledging coverage, publication, linguistic, and temporal limitations.

Review Protocol: The review combines PRISMA-style reporting with pre-specified questions, multi-source searches, inclusion and exclusion criteria, and a coding schema for the selected corpus.Searches covered peer-reviewed venues, arXiv, technical standards and proposals, and open-source or industry documentation, reflecting the field’s reliance on grey literature.
Research Questions: The protocol defines four research questions covering integration architectures, agent-driven transaction threats, interoperability systems and standards, and open problems for a 2026 roadmap.The questions progress from descriptive systematization to a forward-looking agenda, emphasizing interface layers, verifiable policy enforcement, and reproducible evaluation.
Quality Assessment: Source assessment weighted venue, author credentials, methodological rigor, and citation impact, while retaining preprints and technical documentation when they offered unique evidence.Claims from commercially interested organizations were independently checked where possible or qualified with caveats.
Limitations: The survey may underrepresent non-English and cross-disciplinary work, favor successful deployments over failures, and become outdated as agentic AI and blockchain systems evolve.The authors counter publication bias by including grey literature, industry reports, and documented incidents, while focusing on enduring principles and challenges.
Corpus Construction: 317 unique studies, systems, and standards entered the qualitative synthesis, while 85 systems with adequate implementation detail and public documentation were quantitatively coded.The 85-system subset supports the comparative capability matrix.

3 Background: Foundational Primitives

This section frames agent–blockchain interoperability as a multi-stage process transforming observed state into irreversible on-chain transitions, with safety controls spanning observation, authorization, execution, and verification. It then examines programmable wallets, threshold custody, and MEV as foundational security and execution primitives.

Agent Action Pipeline: The six-stage, implementation-agnostic pipeline traces how on-chain, mempool, and off-chain observations become irreversible state transitions, while exposing control points for safety and feedback.Observation can be corrupted by spoofed data, oracle manipulation, indexer compromise, or indirect prompt injection; verification monitors finality, re-organizations, post-state, and remediation.
Programmable Wallets and Account Abstraction: Account abstraction turns wallets from passive key holders into programmable security boundaries where on-chain validation can enforce narrowly scoped agent authority before execution.ERC-4337 supports session keys, time bounds, allowlists, value limits, multi-party approval, conditional checks, and paymaster-sponsored execution.
Programmable Wallets and Account Abstraction: Account abstraction increases flexibility but remains unsafe without careful validation, paymaster policies, simulation, monitoring, and recovery because bundler and mempool dynamics can remain adversarial.Weak validation can recreate broad EOA-like authority, while unsafe sponsorship can subsidize abuse.
Maximal Extractable Value: MEV makes transaction inclusion and ordering an adversarial economic force, so agent systems must incorporate simulation, policy gating, and MEV-aware execution across DeFi primitives.AMMs expose agents to ordering and price-impact extraction, while lending protocols expose them to oracle and liquidation dynamics [55].
Threshold Custody and Signing: MPC and threshold signing separate agent operation from unilateral key control, requiring multi-system compromise or collusion and converting several compromises into policy and quorum failures.This custody layer complements on-chain programmability while preserving user consent and enforceable policy constraints.

4 Taxonomy of Agent–Blockchain Integration Patterns (2025)

The section introduces a five-part taxonomy of agent–blockchain integration patterns that captures the field’s progression in trust, autonomy, and risk. The patterns are ordered by increasing agent authority and risk.

4 Taxonomy of Agent–Blockchain Integration Patterns (2025): The proposed taxonomy organizes emerging agent–blockchain architectures into five distinct integration patterns.It is presented as a framework for understanding the maturing field of agent-blockchain interoperability.
4 Taxonomy of Agent–Blockchain Integration Patterns (2025): The patterns represent a progression in trust, autonomy, and risk rather than merely a collection of technical designs.This framing makes the taxonomy relevant to developers, researchers, and users evaluating agentic Web3 systems.
4 Taxonomy of Agent–Blockchain Integration Patterns (2025): Table 3 orders the integration patterns by increasing agent authority and risk across their defining architectural dimensions.The table summarizes each pattern’s agent authority, primary interface plane, dominant risk, and evolutionary pressure.

I. Read-only analytics

Read-only analytics provides informational, non-executing access to blockchain data for actionable insights. Its data-plane architecture relies on RPC, indexers, and analytics, but outputs may be spoofed, stale, or biased.

I. Read-only analytics: Read-only analytics supplies informational, non-executing blockchain data to support actionable insights.
I. Read-only analytics: Its data plane is built from RPC endpoints, indexers, and analytics components.
I. Read-only analytics: The main risks are data spoofing and stale or biased views, which can make analytics misleading.

V. Multi-agent workflows

Agent–blockchain integration progresses from read-only analysis to autonomous, multi-agent execution as authority increases, interfaces strengthen, and safety requirements become sharper. Multi-agent workflows address autonomous behavior through structured intents, independent verification, and auditable authorization rather than relying on a single agent alone.

Integration taxonomy: The taxonomy charts five integration patterns, progressing from passive read-only agents to fully autonomous multi-agent systems with direct, high-stakes signing capabilities.The progression spans data, decision, policy, custody, and coordination interface planes, with increasing authority and sharper safety requirements.
Read-only analytics: Read-only agents provide auditable synthesis without transaction authority, yet compromised data sources, manipulated feeds, and indirect prompt attacks can still distort downstream decisions.The usability gap between analysis and manual execution motivates structured candidate intents or draft transactions for user approval.
Simulation and intent generation: Pattern II proposes structured transaction intents and simulations for user approval, but its security depends on preview clarity and the user’s ability to evaluate proposals.Users must validate destination contracts and assets, while long, technical, or time-pressured previews increase cognitive burden.
Delegated execution: Pattern III bounds compromise damage through delegated scopes and on-chain caps, although deterministic policies can be rigid or costly to evolve.This model suits recurring automation such as periodic swaps, recurring payments, and routine strategy maintenance.
Autonomous signing: Autonomous signing enables time-sensitive strategies but removes the traditional user safeguard, making institutional-grade custody and defense-in-depth policy enforcement necessary.Failures can produce irreversible, monetizable losses at machine speed; separating Transaction Intent specification from Policy Decision Record authorization provides auditable custody reasoning before MPC or TEE signing.
Multi-agent workflows: Multi-agent workflows separate opportunity discovery from risk verification, with strategy agents producing structured Transaction Intents and verifier agents independently assessing them.Strategy agents monitor markets, protocols, and external signals, while verifier evaluation may include fork-based simulation.

5 Threat Model for Agent–Blockchain Systems

Agent–blockchain systems create a distinctive threat surface by coupling probabilistic reasoning over untrusted inputs with deterministic, irreversible, and economically exploitable execution. The threat model therefore organizes risks around assets, adversaries, trust boundaries, and seven boundary-oriented attack classes while excluding base-layer failures outside the agent-to-chain boundary.

Threat Model Scope: The core risk is asymmetric coupling: attacks can target the agent’s reasoning, policy interpretation, and execution pathways as well as conventional software and infrastructure [32].Errors become irreversible and economically exploitable once translated into deterministic on-chain state transitions.
Assets: The model protects funds and signing authority, permission and policy state, agent state, and telemetry used for detection, simulation, and auditing.These assets include private keys or MPC shares, allowlists and spend limits, memories and tool registries, and transaction previews and policy decisions.
Adversaries: Adversaries include MEV actors, remote attackers, manipulated tools and data sources, malicious protocols, and privileged insiders or operators.Their capabilities range from transaction reordering and sandwiching to compromising runtimes, off-chain inputs, RPCs, or operational infrastructure [80].
Attack Classes: Threats are organized into boundary-oriented classes: cognitive, tool and data-plane, policy and control-plane, signing and custody, and further classes mapped to pipeline stages, assets, and controls.This taxonomy aligns attack classes with trust shifts between users, agents, models, tools, endpoints, and execution components, as summarized in Figure 4 and Table 4.
Assumptions and Non-Goals: The scope assumes secure cryptographic primitives and eventual base-chain finality, but treats applications, frontends, off-chain services, and evolving smart-contract systems as potentially adversarial.Base-layer cryptographic breaks, consensus-safety violations, and sustained L1 network partitions are excluded as non-goals.
Execution and Multi-Agent Threats: A compromised middleware layer can break the binding between an approved preview and the signed bytes, while Sybil agents, bribery, cartels, or correlated compromise can make harmful multi-agent approvals appear procedurally valid.These failures occur at the Authorize–Execute seam and in distributed verification, respectively.

6 Standards and Interface Layers: The Connective Tissue of Agentic Systems (2025)

Agent–blockchain interfaces define trust boundaries, mediate authority, and determine practical security guarantees, yet the 2025 landscape remains fragmented across tool protocols, wallet/signing interfaces, and smart-contract interaction patterns. The section argues for a robust stack in which agents produce declarative intents, wallets enforce deterministic policy and least privilege, and contracts provide agent-friendly, verifiable execution surfaces.

Overview: Interface layers are security boundaries that connect agent reasoning to execution, abstract complexity, enforce policy constraints, and enable safe composability.Poorly designed interfaces can weaken isolation and security guarantees across the system.
Overview: The 2025 ecosystem remains fragmented across de facto standards, proprietary APIs, and emerging open protocols spanning tool invocation, wallet and signing, and smart-contract interaction.These three layers form the connective tissue through which agents discover capabilities, authorize actions, and control on-chain environments.
Tool Invocation Protocols: Legacy custom tool integrations were brittle, difficult to scale, and often collapsed tool access into unrestricted host-process execution, creating severe security risks for irreversible blockchain actions.Application-specific definitions coupled semantics to implementations and required bespoke integration for each new capability.
Wallet and Signing Interfaces: Wallets are the most security-critical boundary because they convert probabilistic intent into deterministic authorization through custody, policy enforcement, consent, and transaction previews.Agentic wallet designs add programmatic signing, explicit policy hooks, typed intent representations, simulation-backed previews, and verifiable logs.
Wallet and Signing Interfaces: Account abstraction enables delegated execution through narrowly scoped, revocable capabilities, while modern wallets combine deterministic on-chain constraints with hardened off-chain custody for defense-in-depth.Session keys, role modules, guards, and spend limiters enforce least privilege even when an agent is compromised; typed authorization and aligned simulation reduce ambiguity between planned, previewed, and signed actions.
Smart-Contract Interaction Patterns: Intent-centric contract interfaces reduce parameter ambiguity by expressing declarative outcomes under bounded constraints, enabling policy simulation, solver competition, deterministic verification, and improved recovery.This shifts agents away from low-level calldata construction and supports a stack where agents produce intents, wallets enforce policy, and contracts emit verifiable machine-readable outcomes.
Identity and Policy Interfaces: Zero-knowledge credentials can let agents prove compliance with complex policies, such as accredited-investor status, without revealing underlying identity data.Self-sovereign identity frameworks preserve user control over credentials while supporting selective disclosure to relying parties.

7 Comparative Capability Matrix: The 2025 State of the Art

Table 6 compares selected systems to expose architectural trade-offs, recurring security controls, and interface gaps. The comparison indicates convergence toward modular, defense-in-depth designs while showing that custody, policy enforcement, recovery, and module correctness remain consequential boundaries.

Comparative matrix: Table 6 provides an information-dense side-by-side comparison that motivates production integration patterns, pipeline security controls, and recurring interface-layer gaps.The matrix also frames the open problems examined later.
Cross-system synthesis: Mature designs converge on defense-in-depth stacks combining smart accounts, intent-centric execution, policy engines, simulation, and observability for verification and recovery.This convergence also clarifies remaining research and standardization gaps.
Wallets and toolkits: Embedded wallets and full-stack toolkits lower adoption barriers for consumer and non-specialist applications, but shift risk toward recovery, service dependencies, approval previews, delegation scope, and platform defaults [149].Their contribution is recoverable, low-friction authorization rather than autonomy, while toolkits’ custody, policy, and routing choices shape the agent’s risk envelope.
Signing and execution infrastructure: Programmable signers, TEE-backed services, decentralized key networks, institutional custodians, and bundlers extend autonomous execution while distributing authority and adding policy, governance, or operational dependencies [169, 314].These systems remove raw key handling, enforce signing conditions, support regulated adoption, and operationalize account abstraction, but require transparency, failure handling, and robust controls.

1inch Fusion (2024)

1inch Fusion exemplifies intent-first execution, while the surrounding agent-blockchain stack combines private submission, simulation, scoped delegation, and programmable policy controls to make autonomous on-chain actions safer and more practical.

1inch Fusion (2024): Fusion lets agents specify outcomes and constraints while a competitive market handles routing, gas, ordering, and adversarial execution dynamics.This improves policy-engine composability and reduces brittle protocol-specific transaction construction.
1inch Fusion (2024): Private transaction submission reduces pre-trade transparency, limiting searchers’ ability to observe, simulate, and adversarially reorder sensitive actions.Flashbots Protect can reduce execution-time losses when combined with strict slippage bounds, deadlines, and intent-based execution paths [135].
1inch Fusion (2024): Pre-execution simulation enables agents to detect reverts, unintended state changes, and economically unfavorable outcomes before irreversible on-chain execution.Tenderly functions as a deterministic safety layer for Observe, Reason, and Verify stages.
1inch Fusion (2024): The ecosystem is converging on programmable smart-account authorization, declarative intents, explicit policy enforcement, and custody models that trade sovereignty against operational control.Policy may be enforced on-chain through smart-account modules or off-chain through custodians and workflow engines; user-held keys maximize sovereignty but combine policy, signing authority, and runtime compromise in one failure domain. General-purpose agent frameworks still lag crypto-native stacks in deterministic policy, simulation, transaction previews, and recovery workflows.

8 2026 Roadmap: TIS and PDR

The roadmap proposes TIS and PDR as standardized interface layers for portable intent specification and verifiable policy enforcement in agent–blockchain execution. Together, they separate flexible planning from deterministic authorization and signing, improving interoperability, security, composability, and auditability.

Policy Decision Record (PDR): PDR is a signed, verifiable artifact proving that a specific TIS object was evaluated and approved or rejected under policy before irreversible signing.Presented to the signer as a signed capability, it creates interoperable evidence for authorization, auditing, and incident response.
Reference architecture: The reference architecture separates the planner, verifier, and executor so compromised agents cannot exceed the permissions jointly enforced by policy evaluation and signing.This defense-in-depth workflow produces a non-repudiable, auditable evidence chain while keeping execution deterministic and narrow in scope.
Expected ecosystem impact: Standardizing TIS and PDR would convert bespoke integrations into portable, verifiable artifacts, reducing protocol-specific coupling while strengthening interoperability, security, composability, and auditability.TIS provides a common interface for solvers and venues, while PDR gives signers proof of pre-authorization policy evaluation.
Adoption and research priorities: Broad adoption requires open standards governance, reference implementations, canonicalization and validation test vectors, solver-ecosystem coordination, and privacy-preserving PDRs.Zero-knowledge attestations could prove policy compliance while selectively revealing only constraints required by the signer.

9 Evaluation: Benchmarks and Checklists for On-Chain Agent Safety

The section proposes holistic evaluation of on-chain agents as end-to-end systems spanning reasoning, authorization, execution, and verification, rather than isolated model or contract components. It combines benchmarks across safety, reliability, and economic robustness with an audit checklist to provide defense-in-depth assessment.

Evaluation Framework: The framework evaluates the full agent–chain pipeline across safety and security, task reliability and robustness, and economic robustness.This addresses the gap left by benchmarks that isolate cognition, code synthesis, vulnerability detection, or gas efficiency and omit the tool–decision–action loop [181].
Safety and Security: Security benchmarks test resistance to prompt manipulation, tool poisoning, policy bypass, and MEV exploitation in controlled forked environments.They include PIR for ignoring or flagging malicious instructions, TSD for cross-validation against manipulated outputs, MVA for value lost relative to MEV-free execution, and PAT for prioritizing constraints over apparent short-term utility; PIR scores below 99% indicate unsuitability for autonomous operation.
Task Reliability and Robustness: Reliability benchmarks stress multi-step DeFi workflows and injected RPC, call-reversion, and transaction-drop failures, measuring success, gas efficiency, latency, reasoning depth, and recovery convergence.Tasks increase from single-protocol interactions to atomic multi-protocol arbitrage, while successful recovery requires diagnosing failure causes and converging on a correct strategy [138, 182].
Economic Robustness: Economic-robustness tests expose agents to pump-and-dump schemes and honeypot contracts, with high ERS indicating reasoning about liquidity, sellability, and execution feasibility rather than surface profit signals.The benchmark treats economic irrationality as a distinct source of harm alongside technical compromise [80].
Audit and Evaluation Practice: A structured audit checklist complements quantitative benchmarks by reviewing observability, authorization boundaries, execution pathways, and recovery mechanisms.High-fidelity evaluation should reproduce latency, gas volatility, liquidity, and adversarial behavior; mainnet forks help replicate state but require complementary testnet and simulation testing, while red teams cover novel attack vectors [200].

10 Case Studies: Architectures in Practice

The case studies translate Patterns III–V into deployable agent-blockchain architectures, tracing execution flows and the security trade-offs of increasing autonomy. They show that bounded authority, separated policy and execution duties, distributed trust, observability, and gradual deployment are central to safer operation.

Evaluation benchmarks: The proposed benchmarks specify consistent tests for prompt-injection resistance, transaction reliability, and execution quality across attack types, transaction classes, and trade sizes.They define metrics including attack success, detection, false positives, transaction success, simulation accuracy, price impact, MEV leakage, gas efficiency, and latency.
Pattern III: On-chain limits bound compromise: the worst-case loss is capped at 10 USDC per interval, with trust anchored in audited modules rather than agent-runtime correctness.The on-chain logic cannot be bypassed by a compromised agent, sharply limiting the attack surface.
Pattern IV: TIS/PDR separation assigns intent proposal, compliance evaluation, and signing to distinct components, while independent controls provide defense-in-depth, auditability, and an operational kill switch.A bounded TIS is paired with a signed PDR, and the signer enforces both before producing a signature.
Pattern V: Pattern V distributes proposal generation, safety evaluation, and execution across agents, using staking, slashing, evaluator diversity, and on-chain records to resist collusion and support accountability.Proposal artifacts, votes, and execution events remain available for public audit and post-incident attribution.
Case studies: Patterns III–V instantiate bounded delegation, policy-driven autonomy with distributed custody, and organizational autonomy through specialized agents and on-chain governance constraints.Each case study follows setup, intent construction, authorization, submission, and verification while locating controls across on-chain modules and off-chain policy engines.
Cross-cutting lessons: Safe deployment should begin in read-only or simulation-only modes, expand authority and spending limits gradually, and pair execution with monitoring of success, economics, compliance, and behavior.Observability supports faster incident detection, debugging, performance assessment, and anomaly detection for security issues or strategy drift.

11 Related Work

This survey unifies research on agentic tool use, blockchain execution, and decentralized finance around the agent-to-chain interface. It translates established security, MEV, intent, interoperability, identity, and governance work into a security-critical framework motivating standardization and evaluation benchmarks.

11 Related Work: The survey provides a standards- and interface-centric synthesis of agentic AI, blockchain execution infrastructure, and decentralized finance, complementing component-specific surveys.It focuses on the interface layer connecting agents to on-chain action and clarifies a design space for 2026.
11 Related Work: It translates LLM tool-use threats—including indirect prompt injection, data exfiltration, insecure invocation, and denial of service [181] [131]—into agent-to-chain risks involving value-bearing state transitions.The contribution extends general LLM-to-tool interface analysis to tools that can directly trigger on-chain actions.
11 Related Work: The survey treats MEV as a standing adversary for autonomous agents, building on research on front-running, sandwiching, supply chains, relays, builders, and private-orderflow mitigations [80].This connects transaction-ordering research to autonomous on-chain execution.
11 Related Work: Its Transaction Intent Schema builds on intent-centric architectures that separate desired outcomes from protocol-specific execution, including solver-based execution and competitive orderflow [71].Prior work frames intent-centric execution as both an interaction model and an execution-layer mechanism that changes trust and threat assumptions.
11 Related Work: The survey combines smart-contract security, scalability, cross-chain, identity, credential, and DAO-governance research to motivate conservative execution, interoperable authorization, and multi-party approval workflows [85] [205] [102].Together, these strands support standardization efforts for intent schemas, policy attestations, and evaluation benchmarks.

12 Conclusion and Future Work

The survey maps agent-blockchain interoperability through a five-part taxonomy, blockchain-specific threat model, and comparative capability matrix, while emphasizing that trustworthy autonomy remains an early-stage frontier. It identifies standardization, measurable assurance, formal safety, accountable oversight, and user-centered controls as priorities for responsible on-chain autonomy.

Survey Contributions: The survey synthesizes 317 sources into a five-part integration taxonomy, a blockchain-specific threat model, and a capability matrix covering custody, permissions, policy locus, observability, and MEV mitigation.These contributions expose dominant design tradeoffs across the agent-blockchain interoperability landscape.
Standardization and Assurance: Standardized intent and policy artifacts, combined with domain-specific benchmarks and checklists, are presented as the path toward composable, auditable, and measurable on-chain autonomy.They can reduce integration brittleness, clarify accountability boundaries, and convert qualitative security claims into repeatable evidence under prompt injection and related threats.
Formal Safety: The central technical challenge is constraining probabilistic agent behavior within formal safety envelopes before outputs trigger irreversible smart-contract state changes.Promising directions include compositional reasoning across tool calls, policy checks, and execution venues, alongside symbolic constraints.
Economic Dynamics: Large populations of profit-seeking agents may amplify feedback loops, exploitation, and tacit coordination, especially in thin-liquidity settings and solver markets.Open questions include equilibrium outcomes under repeated interaction and the pricing of off-chain computation, solver competition, and verification overhead.
Accountability and Oversight: Trustworthy autonomy requires auditable safety claims, verifiable policy decision artifacts, reproducible evaluations, risk-sensitive insurance, and clear responsibility across operators, policy issuers, and execution venues [57].Identity, key management, policy provenance, and conditional coverage are highlighted as components of enforceable oversight.
Adoption and Coordination: Mainstream adoption depends on concise, faithful rationales and intuitive controls for session keys, spend limits, allowlists, and revocation, aligned with account abstraction and recovery patterns.Progress requires coordinated work across agent security, smart contracts, MEV research, cryptography, human-computer interaction, and standards processes [80] [131].

A Transaction Intent Schema (TIS) - Reference Implementation … A.3 Extension Points

The reference implementation defines TIS as a chain-agnostic, extensible JSON Schema Draft-07 for machine processing and human review. It specifies required intent structure, typed action variants, canonicalization before signing, and versioned extension points.

A Transaction Intent Schema (TIS) - Reference Implementation: TIS uses modular JSON Schema Draft-07 definitions to represent chain-agnostic transaction intents with machine-readable and reviewable structure.The implementation is designed for clarity and supports both machine processing and human review.
A.1 Top-Level TIS Object (JSON Schema Draft-07): The top-level object requires version, intentId, action, and constraints fields while optionally supporting metadata and preferences.The schema rejects unspecified top-level properties and fixes the version pattern to 1.0.0.
A.1 Top-Level TIS Object (JSON Schema Draft-07): Action validation selects exactly one of three variants: SWAP, TRANSFER, or DELEGATE.The action definition uses oneOf references to the Swap, Transfer, and Delegate schemas.
A.1 Top-Level TIS Object (JSON Schema Draft-07): SWAP requires input and output tokens, input amount, minimum output, and supports slippage and recipient constraints.Token objects include chainId and address fields, while amount fields use unsigned decimal strings.
A.1 Top-Level TIS Object (JSON Schema Draft-07): TRANSFER requires a token, destination address, and amount, with an optional memo.The transfer schema fixes the action type to TRANSFER and disallows additional properties.
A.1 Top-Level TIS Object (JSON Schema Draft-07): DELEGATE represents scoped authority through a delegatee, contract and function limits, maximum value, and an expiration bound.The delegation schema constrains delegated execution using explicit scope fields and a valid-until condition.
A.2 Notes on Canonicalization and Hashing: Implementations should canonicalize TIS objects with deterministic key ordering before hashing and signing so clients derive identical hashes for the same semantic intent.Future action types and metadata, constraint, or preference fields can extend the schema while versioning preserves backward compatibility.

B Policy Decision Record (PDR) - Reference Implementation … D.7 General

The appendix operationalizes policy-gated agent execution through a signed PDR bound to a specific transaction intent, then organizes systems into progressively stronger conformance levels and deployment safeguards. It also provides representative configurations and an end-to-end safety checklist spanning observation, reasoning, construction, authorization, execution, recovery, and governance.

B Policy Decision Record (PDR) - Reference Implementation; B.1 Top-Level PDR Object (JSON Schema Draft-07): A PDR is a signed policy-engine attestation binding an evaluated intent hash to an approval or rejection outcome and any imposed constraints.The schema includes issuer, audience, validity times, decision metadata, risk scoring, bound limits, parameter modifications, and a policy-engine signature.
B.2 Verification and Execution Flow: The execution flow creates a TIS, evaluates it through a policy engine, issues a signed PDR when approved, and submits both artifacts to an MPC service, HSM, or TEE for signing.The signer verifies the PDR signature, intent hash, expiration, audience, and enforcement of constraints before signing.
C Conformance Levels for Agentic Systems; C.1 L0: Unconstrained Agent; C.2 L1: Basic On-Chain Policy Controls; C.3 L2: Off-Chain Policy and Mandatory Simulation; C.4 L3: Hardware-Secured Signing and Distributed Approval: The four conformance levels progress from unconstrained private-key access to hardware-isolated or distributed signing with quorum approval, reducing maximum loss under compromise.L0 permits arbitrary transactions and carries catastrophic compromise risk; L1 adds on-chain limits, L2 adds policy evaluation and mandatory simulation, and L3 adds TEE/HSM or MPC, quorum approval, and recovery controls.
C.5.2 Configuration 2: Active Trading Agent: The active trading configuration prioritizes rapid execution through latency-optimized MPC, a 100ms target, no required simulation, position and exposure limits, and automated rebalancing.It permits transactions up to 100000 USD, caps single positions at 25% and protocol exposure at 40%, and uses private-mempool MEV protection with 2% maximum slippage.
C.5.3 Configuration 3: Governance Participation Agent: The governance configuration manages DAO voting and delegation with abstention by default, low-impact automated voting, human review for high-impact proposals, curated delegates, and delegation caps.It limits delegation per delegate to 20%, imposes a 7-day redelegation cooldown, and tracks proposals, alerts, deadlines, and delegation performance.
D Agent–Blockchain Safety Checklist; D.1 Observe; D.2 Reason; D.3 Construct: The safety checklist covers the action pipeline by requiring robust observation and reasoning, standardized TIS construction, forked-state simulation, human-readable previews, and replay and deadline protections.It also checks resistance to instruction hijacking, MEV awareness, permission modeling, audit logging, oracle and stale-price hazards, and authenticated data sources.
D.4 Authorize; D.5 Execute; D.6 Verify & Recover; D.7 General: Authorization, execution, recovery, and governance controls include PDR-bound decisions, isolated or distributed signing, private orderflow, outcome verification, kill switches, incident response, audits, secure secrets, reproducible benchmarks, and policy-change governance.The checklist additionally addresses failed or stuck transactions, partial workflow failures, safe updates, disclosure programs, encrypted communications, patching, risk disclosures, and dispute resolution.

D.8 Additional Implementation Notes · E Glossary of Terms

The implementation notes emphasize layered testing, operational monitoring, incident response, and personnel controls for safer agent-blockchain deployment. The glossary standardizes core concepts spanning agents, authorization, execution, security, blockchain infrastructure, and the proposed TIS and PDR abstractions.

D.8 Additional Implementation Notes: Testing should combine unit, integration, and end-to-end tests, with emphasis on edge cases, error handling, and adversarial scenarios.Mainnet forks provide realistic state without risking funds, but testnets and simulations remain necessary because forks omit latency, gas dynamics, and other participants’ behavior.
D.8 Additional Implementation Notes: Production systems should monitor transaction success, gas consumption, execution latency, and economic performance, using anomaly detection and calibrated thresholds to balance sensitivity against false positives.Thresholds require regular review because excessive sensitivity causes alert fatigue, whereas insufficient sensitivity can miss genuine issues.
D.8 Additional Implementation Notes: Incident response should cover detection, containment, investigation, remediation, and review, supported by rapid shutdown, credential revocation, affected-party communication, and regular drills.These capabilities help minimize harm and ensure personnel understand their roles during security incidents.
D.8 Additional Implementation Notes: Operational security requires separation of duties, access logging and review, regular assessments, personnel screening and training, acceptable-use policies, and secure offboarding.These practices address threats that technical controls alone cannot prevent, including insider risks in systems managing significant value.
E Glossary of Terms: The glossary defines agents and agentic AI as autonomous goal-directed systems, while LLMs and tool use provide their language and external-system capabilities.It also distinguishes account abstraction, custody, EOAs, wallets, smart contracts, and guardrails as foundational authorization and control concepts.
E Glossary of Terms: Execution terminology covers intents, session keys, UserOperations, bundlers, gas, slippage, MEV, and prompt injection as mechanisms or risks in agent-mediated transactions.The glossary also defines DeFi, oracles, rollups, and smart contracts as surrounding blockchain infrastructure and services.
E Glossary of Terms: The glossary defines MPC and TSS as distributed cryptographic controls, alongside custody, account abstractions, and temporary session keys for managing signing authority.It also identifies wallets, EOAs, UserOperations, and bundlers as components of blockchain account and transaction infrastructure.
E Glossary of Terms: TIS specifies transaction intents in a structured, machine-readable format, while PDR records policy decisions to create auditable authorization trails.These are proposed standards for portable intent expression and verifiable policy enforcement.