Thesis · Working draft v0.1 · Not a product claim
Private Context for Autonomous Finance
Why agents need privacy before they can manage real assets on Robinhood Chain
Abstract. Autonomous agents are becoming economic actors. To manage real assets, they need memory, strategy, constraints and authority — inputs that are often more sensitive than the transaction itself, and that are routinely exposed to model providers, logs, platforms and the tools in between. This thesis argues that the missing layer for agent finance is not privacy for money but privacy for context: settlement can remain public and auditable while the context that produces a decision stays private, with selective disclosure where audit requires facts. We outline four research primitives and the evidence that would be required before any of them can be described as working. We claim no product, no audit and no no-logs guarantee.
1 · The agent's dilemma
An agent that acts for you must know your positions, your limits, your history and your intent. The better it does its job, the more of that context it accumulates. Memory reveals who you are; intent reveals what you are about to do; authority is the power to act at all.
Today that context leaks by default. It is pasted into prompts, retained in provider logs, mirrored into tool ecosystems and cached in places the user never chose. The exposure grows with capability: a more useful agent is a more revealing one.
Privacy here is not a feature bolted onto agent products. It is a precondition for trusting one with real money.
2 · What privacy should mean here
Four different things get called privacy in this space. Transaction anonymity — hiding who moved what — is not this project's focus and carries heavy regulatory weight. Verifiable settlement — public, auditable execution — is something we want to keep. The two we research are context privacy (memory, strategy, constraints stay with the user) and selective disclosure (an auditor receives the facts a scope requires, not the whole context).
The wager, in one line: public settlement, private context.
3 · Four primitives
Scoped authority — an agent acts inside limits you set (amounts, actions, assets, expiry, revocation), never with unrestricted keys. Local-first memory — what the agent remembers about you is encrypted on your side, exportable and deletable. Private intent — a strategy stays private until execution, while settlement stays public. Selective disclosure — compliance receives scoped facts rather than full context.
Each primitive also defines what it does not solve. Scoped authority does not make an agent competent. Local memory does not hide the prompt from the model that must read it. Private intent does not conceal executed transactions. Selective disclosure does not eliminate trust in the auditor. The boundaries are part of the design.
4 · A target architecture (design)
Conceptually: user policy and encrypted memory live on the user's side; an agent runtime consumes them under scoped authority; a relay boundary stands between private context and public settlement; audit reads scoped disclosures. Every component here is design vocabulary, not an implementation. Failure modes we design against include relay unavailability, agent compromise, key loss, disclosure overreach and regulatory conflict.
If only one piece can be built first, it is scoped authority plus local memory — the smallest honest demonstration of the thesis.
5 · Threat model (public summary)
Assets: agent memory, strategy and intent, delegated authority, audit records. Adversaries: model providers and platform logs, intermediaries and relays, front-runners observing intent, compromised agents or supply chains, and over-reaching disclosure demands. Trust boundaries: device to service, runtime to chain, user to auditor. This public summary deliberately omits attack specifics.
6 · What would make this credible
Stages, not dates. A stage moves only when its evidence exists: a published thesis; a reviewed design with an external reader; a reproducible local prototype; independent verification; and only then anything resembling a product. We do not claim a no-logs guarantee, anonymity, an audit or attestation — those words describe evidence we do not yet have.
7 · Open questions
How should privacy and audit obligations be balanced for real-world assets? Are latency and cost premiums for private intent acceptable? How does a user recover or migrate local memory? What is the honest revocation story for delegated authority? Which jurisdictions' disclosure rules apply, and what do they actually require? These are open. If you can poke holes in this document, that is the document working as intended.