NoVault: Non-custodial Coordination for Agent Workflows
A protocol for intent-driven capability resolution, provider competition, request-level settlement, and cryptographic execution verification in autonomous multi-agent systems.
Abstract
Autonomous software agents increasingly need to coordinate financial operations — payments, data purchases, compute procurement — without holding funds or exposing private keys. Existing solutions require agents to either custody assets directly (introducing catastrophic key-loss risk) or rely on a centralised intermediary (reintroducing the trust assumptions they were designed to eliminate).
NoVault introduces a non-custodial coordination layer that translates high-level agent intent into verifiable, settled transactions. Agents declare what they need; the protocol resolves how, from whom, and at what cost. Every paid call settles at the request level. Every outcome is cryptographically attested.
Agents should be able to pay for compute, data, and services the same way humans use a card — without carrying a wallet, managing keys, or trusting an operator.
1. The Problem
The agent economy is growing faster than the infrastructure that supports it. When an LLM agent needs to call a paid API, purchase a dataset, or spin up compute, it faces a trilemma:
Self-custody
Agent holds keys directly. A single prompt-injection or jailbreak drains funds permanently.
Delegated custody
A centralised operator holds funds on behalf of agents. Trust is fully re-centralised.
No payments
Agents are restricted to free-tier APIs, severely limiting capability and reliability.
1.1 Provider fragmentation
Even when payment is solved, capability discovery remains manual. Agents are hard-coded to specific providers via custom SDK integrations. When a provider raises prices, degrades quality, or goes offline, the agent fails. There is no market-clearing mechanism for agent-to-service relationships.
1.2 Billing opacity
Current billing is aggregated monthly or per-seat. Agents cannot attribute cost to individual reasoning steps. Budget enforcement is coarse-grained. Abuse is discovered retrospectively, not prevented structurally.
2. Architecture Overview
NoVault is composed of four cooperating layers. Each layer has a narrow, well-defined responsibility and communicates with adjacent layers through machine-readable schemas.
┌─────────────────────────────────────────┐
│ Agent (intent consumer) │
│ { capability: "image/upscale", ...} │
└──────────────────┬──────────────────────┘
│ Intent declaration
┌──────────────────▼──────────────────────┐
│ Capability Resolution Layer │
│ Schema match → ranked provider set │
└──────────────────┬──────────────────────┘
│ Scored provider list
┌──────────────────▼──────────────────────┐
│ Settlement Layer (per-request) │
│ Escrow → execute → release / slash │
└──────────────────┬──────────────────────┘
│ Signed receipt
┌──────────────────▼──────────────────────┐
│ Verification Layer │
│ Deterministic re-execution or ZK proof │
└─────────────────────────────────────────┘No layer persists funds beyond the lifetime of a single request. Escrow is opened, the request executes, and the escrow collapses — all within a single atomic operation. Agents never hold a spendable balance.
3. Capability Resolution
Providers publish machine-readable capability schemas to a permissionless registry. A schema declares the capability identifier, input/output contract, pricing model, quality-of-service commitments, and cryptographic identity.
{
"capability": "image/upscale",
"version": "1.2.0",
"input": { "type": "image/png", "maxBytes": 10485760 },
"output": { "type": "image/png", "scale": [2, 4, 8] },
"pricing": {
"model": "per-request",
"unit": "megapixel",
"rate": "0.0004 USDC"
},
"sla": { "p99LatencyMs": 3000, "uptimePct": 99.5 },
"identity": { "did": "did:novault:0xabcd…" }
}3.1 Intent matching
When an agent expresses intent, the resolution layer queries the registry for all schemas that satisfy the declared capability type and input contract. Candidates are ranked by a scoring function that weights price, historical SLA compliance, and semantic schema fit.
3.2 Provider competition
Providers compete on observable, on-chain metrics. There is no preferred partnership. A new provider with better pricing and equivalent SLA history immediately becomes eligible for resolution. This creates structural downward pressure on price and upward pressure on reliability.
4. Request-level Settlement
NoVault settles every service call individually, not in aggregate. The payment lifecycle for a single request is:
- 01
Intent lock
The agent co-signs an intent object specifying capability, provider, maximum price, and TTL. No funds move yet.
- 02
Escrow open
A non-custodial escrow contract receives the agreed payment amount. Neither the agent nor the provider controls it unilaterally.
- 03
Execution
The provider executes the request and returns output alongside a signed execution receipt.
- 04
Settlement
The receipt is verified. If valid, escrow releases payment to the provider. If invalid or late, the agent is refunded and the provider's stake is slashed proportionally.
4.1 Budget enforcement
Agents may attach a spend policy object to their intent. The protocol enforces maximum-per-request, maximum-per-session, and capability-class limits at the settlement layer — before execution, not after. An agent cannot accidentally overspend; it can only under-spend.
5. Verifiable Execution
Every execution receipt is a cryptographically signed attestation that binds the provider identity, request hash, output hash, latency, and timestamp into a single unforgeable object.
{
"receiptVersion": "1",
"requestHash": "sha256:3f4a…",
"outputHash": "sha256:9c1b…",
"provider": "did:novault:0xabcd…",
"executedAt": 1753996800,
"latencyMs": 1240,
"signature": "0x7e3f…"
}5.1 Deterministic verification
For deterministic capabilities (data retrieval, schema validation, structured transforms), a third-party verifier node re-executes the request against the same provider schema and compares the output hash. Disagreement triggers the slashing mechanism.
5.2 ZK verification (roadmap)
For non-deterministic capabilities (LLM inference, generative models), the protocol is designed to accept ZK proof of correct execution once suitable proving systems reach production readiness. The receipt format is forward-compatible with ZK attestation fields.
6. Orchestration Principles
Intent-first
Agents declare what they need, not how to get it. The protocol handles provider discovery, negotiation, and execution routing. This separates application logic from infrastructure concerns and makes agents portable across providers without code changes.
Provider-agnostic
No provider is privileged at the protocol level. The registry is permissionless: any entity that publishes a valid schema, bonds collateral, and passes schema verification is eligible for resolution. Incumbents cannot block new entrants.
Request-settled
Settlement is atomic to the request. There are no monthly invoices, no batched reconciliation, no credit risk. A provider is paid exactly when — and only when — a valid execution receipt is confirmed. An agent is refunded exactly when a receipt fails validation.
Non-custodial by construction
The protocol never holds funds in an operator-controlled account. Escrow contracts are governed entirely by protocol rules and agent co-signatures. An operator compromise cannot drain agent funds because operators never have unilateral access.
7. Security Model
7.1 Threat model
NoVault assumes a Byzantine threat model: any single participant — agent runtime, provider, or verifier node — may be compromised or malicious. Safety is maintained as long as no two-thirds supermajority of verifier stake is colluding.
7.2 Prompt-injection resistance
Because agents never hold spendable balances, a successful prompt injection cannot exfiltrate funds. The worst case is that an attacker causes the agent to execute legitimate but unintended requests up to its declared spend policy limit. The protocol caps blast radius structurally.
7.3 Provider slashing
Providers bond collateral proportional to their declared throughput capacity. A failed receipt results in a proportional slash. Multiple failures within a rolling window trigger an automated suspension from the resolution layer. Collateral is partially returned to harmed agents and partially burned.
Security in NoVault is not a feature layer — it is a consequence of the economic structure. Honest behavior is strictly dominant for all participants.
8. Conclusion
NoVault provides a minimal, composable primitive for agent-to-service coordination: intent declaration, capability resolution, request-level settlement, and verifiable execution. The protocol does not require agents to manage keys, trust operators, or hard-code provider integrations.
The design prioritises structural safety over feature richness. Non-custody is not a product choice — it is an architectural guarantee enforced at every layer of the stack.
The specification described in this document is an active draft. Formal verification of the settlement and slashing contracts, the ZK execution roadmap, and the governance model for registry curation are ongoing work streams. Community review and contributions are welcome.