16Trust
Security and Trust Model
Security that is independently enforceable. Seven trust boundaries and the protections that sit on each.
Security in Motes is independently enforceable wherever possible. A natural-language model can propose actions and summarise risk. It cannot substitute for wallet cryptography, contract invariants, formal access controls, audited adapters or asset-price integrity.
Trust boundaries
| Boundary | Main concern | Required approach |
|---|---|---|
| Owner wallet → Motes app | Phishing and wrong signatures | Clear domain, typed signing and payload review |
| App → agent service | Instruction spoofing | Authenticated policy IDs and integrity checks |
| Agent → smart account | Unauthorised spending | Scoped signature and on-chain policy enforcement |
| Account → DeFi adapter | Malicious calldata | Target, selector, recipient and amount checks |
| Adapter → protocol | Contract and oracle risk | Vetted integrations, ceilings and monitoring |
| Chain → off-chain data | Reorgs and stale prices | Confirmations, reconciliation and timestamp guards |
| Upgrade administrators | Privilege escalation | Multisig, governance boundaries and time locks |
Essential protections
- No unrestricted AI custody of user private keys.
- Owner-initiated pause and authorisation revocation.
- Session expiration and replay protection.
- Per-action and aggregate budget controls.
- Safe contract-approval management and recipient checking.
- Independent contract testing and third-party security reviews before live deposits.
- Explicit incident handling for lost access, unavailable markets and compromised infrastructure.