Agent identity & spend control · ENSv2 + Arc + Privy

ENS subnames are revocable powers of attorney for AI agents. Arc is where they spend.

An organization issues each agent a subname that is non-transferable, self-expiring, and instantly revocable. The subname’s resolver records are the mandate — its budget, its allowlist, its expiry. Revoke the role, and the agent’s next payment dies mid-flight.

Launch the observatory →Read the architecture

research.acme.eth — mandate active

Three planes, one source of truth

Identity and permissions belong on Ethereum, where they’re portable and legible. High-frequency machine payments belong on a chain where gas is USDC and settlement is deterministic. Splitting the two is the design, not a compromise.

01Sepolia

Authority

ENSv2 holds what each agent is allowed to do. Nothing else is authoritative — amending a mandate means writing an ENS record, on a name the org's own registry controls.

02Off-chain

Enforcement

The Enforcer watches Sepolia and compiles each mandate into a Privy policy and a signed Arc anchor. A propagator, not an authority — it can only ever narrow, never widen.

03Arc

Money

Where value actually moves, checked against the anchor on every spend. Gas is USDC, settlement is deterministic, and the agent's own wallet holds almost nothing.

“Privy already does scoped permissions — why a chain?”

The question every judge who knows Privy will ask. Three answers, all citable against Privy’s own documentation.

Public

not private

Privy's controls are internal to one app. A vendor can resolve research.acme.eth and check an agent's authority before accepting a job — Privy has no equivalent for a counterparty.

~10

rolling budgets, per app

Privy's stateful policies cap at roughly ten aggregations per app, can't partition by wallet, and top out at a 72-hour window. The chain has no such ceiling.

Race-free

by construction

Privy’s own docs: aggregation values update after a request is signed, not before — concurrent spends can both pass. The on-chain ledger closes that window.

How a mandate moves

Issue

The org composes a mandate live: budget, per-tx cap, allowlist, expiry, sub-delegation depth. One ENS subname is minted with its own dedicated resolver — no hard-coded values, ever.

Attenuate

An agent can delegate a strictly narrower slice of its own mandate to a sub-agent. Never wider — enforced by the contract's own math, not by convention or trust.

Spend

Every payment checks the anchor first: revoked? expired? over the per-tx cap? off the allowlist? stale? Five ways to fail closed, one to succeed.

Revoke

One transaction on Sepolia. The Enforcer tears down the Privy policy and flips the Arc anchor — the agent's next payment is refused mid-flight, on-chain.

The Enforcer trust model

A dead or censored Enforcer freezes every agent. It doesn’t free them.

assertSpend reverts if the anchor hasn’t been synced or heartbeat-ed within its staleness window — on purpose. Most systems that watch a chain fail open when the watcher goes down. This one doesn’t.