Trust
Commitments enforced by architecture, not policy.
Mints is money infrastructure for autonomous agents. These are not compliance statements — they are architectural commitments, enforced by the system's design.
Illustrative event sequence. Each balance is computed by replaying the event log from origin.
Signing happens locally — this is enforced by architecture.
Every privileged operation is authorized server-side.
Balances are derived by replay — never edited directly.
Six commitments
The design is the guarantee.
Self-custody mandate
Agent private keys are generated and held on the agent's device. They never touch Mints servers. Transaction signing happens locally — this is enforced by architecture, not policy.
A bank can confiscate from its customers at will. Mints, by architecture, cannot.
Event-sourced immutability
Every state change is an immutable event. Balances are derived, never edited. Any account's history can be replayed to any point in time.
Authorized at the boundary
Every privileged operation authorizes server-side against centrally managed sessions and per-route permissions. There are no trusted clients.
Lineage isolation
Funding and visibility require proof of shared identity lineage. One organization can never fund, view, or control another organization's agents — cross-lineage requests fail closed.
A custody spectrum, not a custody compromise
Autonomous spend runs on self-custody; treasuries run on guarded custody with multi-sig quorums and guardian recovery. You choose per account, and both sides are audited identically.
Agent accounts
Keys on device
Org treasury
m-of-n quorum
Identical immutable audit trail
Every event append-only across both modes
You choose per account
Custody model set at account creation, not globally
Both fail closed cross-lineage
Cross-lineage requests blocked regardless of custody mode
These are not compliance statements — they are architectural commitments, enforced by the system's design.
Lineage isolation
One organization can never touch another's agents.
Funding and visibility require proof of shared identity lineage. Cross-lineage requests fail closed at the protocol layer — no access control list to misconfigure.
Cross-lineage requests are rejected at the protocol layer — no configuration required.
Custody
Two modes. One audit trail.
Autonomous spend runs on self-custody. Treasuries run on guarded custody with multi-sig quorums and guardian recovery. You choose per account — both sides are audited identically.
Self-custody
Keys stay on the agent's device.
The private key is generated locally and never transmitted. Transaction signing happens on-device. Mints holds no key material.
Guarded custody
m-of-n quorum. Guardian recovery.
Organization treasuries run on threshold multi-sig. A quorum of guardians must approve. Recovery ceremonies are audited and logged identically.
Shared across both custody modes
Identical audit trail
Every event is append-only in both modes
Per-account choice
Custody model set at account creation
Lineage-bound by default
Cross-lineage blocked regardless of mode
Security you can audit, not just trust.
Every Mints commitment is verifiable in the architecture. Request early access and inspect the design.