Agacy: Agentic AI with Privacy

Agacy lets AI agents act on Solana without exposing payment amounts or balances, combining confidential transfers, policy-bound wallet access, and auditable execution graphs.

Comment

Inspiration

AI agents are moving beyond conversation. They can purchase data, renew subscriptions, pay vendors, manage infrastructure, and interact with on-chain services. However, giving an AI agent access to a conventional blockchain wallet creates two serious problems.

First, blockchain transactions are public by default. Payment amounts and wallet balances can reveal supplier pricing, spending habits, treasury runway, and business activity. Second, instructions such as “never spend more than 2 tokens” are usually only prompts. A prompt is guidance for the model, not a security boundary.

We built Agacy around a simple principle:

Give an AI agent a goal, not unrestricted access to your wallet.

Privacy is not merely a security feature. It is an adoption requirement for individuals and organizations that want on-chain automation without publishing their financial activity.

What it does

Agacy is a confidential, policy-controlled execution layer for AI agents on Solana.

An owner connects a wallet, creates an agent, defines its spending policy, and provisions an owner-funded confidential treasury. A vendor independently connects its wallet and creates a confidential payment account for the same Token-2022 mint. The owner then imports the vendor’s public payment profile.

After setup, the owner can provide a natural-language goal such as:

Renew my market-data subscription. Check my wallet and spending policy, verify that the provider is operational, and if every check passes, pay exactly 2 tokens confidentially to my onboarded vendor.

Agacy expands that request into a live execution graph containing observations, tool calls, policy checks, verified results, payments, refusals, and completion states.

Before value moves:

  1. The agent identifies the required actions.
  2. Relevant tools inspect the wallet, policy, market data, or vendor status.
  3. External information can be verified through AISA-powered services.
  4. Payment details are validated against the imported vendor profile.
  5. The transaction must pass the owner-controlled policy.
  6. Token-2022 Confidential Transfer encrypts the amount and confidential balances.
  7. Agacy reads the resulting on-chain state and produces privacy and accounting evidence.

The result is autonomous execution without treating the AI model as the ultimate authority over funds.

Privacy without misleading claims

Agacy provides confidentiality, not complete anonymity.

The current prototype cryptographically protects transfer amounts and confidential token balances. It also verifies that the plaintext payment amount is absent from the recipient’s raw account data.

A public observer can still see that a transaction occurred, along with its accounts, timing, fees, mint, and program interactions. Some address linkability therefore remains visible.

Agacy makes this boundary explicit in the product instead of presenting privacy as a binary promise. Public and owner-authorized views use structurally different data types, preventing sensitive fields from accidentally entering the public interface.

How we built it

Agacy combines current state-of-the-art Solana privacy primitives with an agent-specific authority and audit layer.

The application is built with Next.js, React, and TypeScript. The Agent Graph uses the Vercel AI SDK with an OpenAI-compatible model for goal interpretation and tool selection. Straightforward payments with complete details follow a deterministic path, avoiding unnecessary model calls.

AISA serves as Agacy’s external AI and data infrastructure integration. AISA-backed CoinGecko and Tavily services allow the agent to independently check market information and research vendor or protocol conditions before performing consequential actions. AISA calls are visibly attributed through orange execution nodes and recorded in the run metrics.

On Solana, Agacy uses:

  • Token-2022 Confidential Transfer for encrypted amounts and balances.
  • Solana’s ZK ElGamal proof infrastructure for confidential state verification.
  • A Rust and Anchor policy program with PDA-controlled custody.
  • Wallet-derived confidential keys that remain in the browser session.
  • Separate public and authorized DTOs to enforce the privacy boundary in the type system.
  • AES-GCM through the Web Crypto API for the encrypted reasoning path.

The prototype runs on Solana devnet using real wallet signatures, real owner-funded accounts, vendor-provisioned recipient accounts, and real on-chain transactions. The primary browser payment flow does not substitute a server-funded demonstration wallet.

Challenges we faced

Making confidential transfers usable

Token-2022 Confidential Transfer is not a single transfer instruction. It requires confidential accounts, wallet-derived encryption keys, proof generation, context accounts, pending balances, and multiple transactions. This made browser execution and recovery substantially harder than a conventional SPL token transfer.

Separating intelligence from authority

The model needed enough freedom to decompose a goal and choose tools, but it could not be trusted to invent recipients, change amounts, or declare a payment successful without evidence. We introduced restricted tool availability, deterministic payment validation, imported vendor profiles, explicit clarification states, and verified tool-result nodes.

Proving privacy visibly

Encrypted bytes alone are difficult to demonstrate. We added a privacy-proof view that traces the settlement signature, checks that the amount ciphertext landed, verifies that the plaintext amount is absent from raw account bytes, and accounts for the transaction fee and resulting balance.

Being honest about blockchain metadata

We initially approached privacy too broadly. During development, we learned to distinguish confidentiality from anonymity. Amounts and balances can be hidden while transaction existence, addresses, timing, and fees remain observable. This distinction is now shown directly in the interface.

Maintaining a safe public view

Hiding fields with CSS would not provide a reliable privacy boundary. Agacy instead uses separate public and authorized DTOs. The public type does not contain the owner’s goal, payment amount, recipient details, balance, or private reasoning.

What we learned

The most important lesson was that private agent payments require more than encryption.

A useful system must combine:

  • Confidential settlement.
  • Authority enforced outside the model.
  • Explicit key custody.
  • Honest refusal and clarification.
  • Owner recovery.
  • Auditable evidence that ordinary users can understand.

We also learned that privacy can improve adoption. Businesses are unlikely to automate supplier payments or treasury operations on-chain if every payment reveals pricing, balances, and operational patterns. Confidentiality makes verifiable blockchain settlement more compatible with real financial workflows.

Accomplishments

  • Built a live goal-driven Agent Graph instead of a predefined animation.
  • Executed real Token-2022 confidential payments on Solana devnet.
  • Added independent vendor onboarding and exact-wallet verification.
  • Implemented owner-funded treasury setup with policy-controlled custody.
  • Verified that plaintext payment amounts are absent from raw recipient account bytes.
  • Added public and authorized views with different DTO contracts.
  • Integrated AISA-backed research and market-data tools.
  • Added payment accounting for amount spent, remaining balance, and Solana fees.
  • Tested policy violations, amount mismatches, unauthorized actions, and owner recovery.
  • Reached 258 passing automated tests across the application and security boundaries.

Target users

Agacy is designed for:

  • Individuals delegating subscriptions and recurring purchases.
  • Startup finance teams automating SaaS and infrastructure payments.
  • DAO treasury operators managing contributor payouts and grants.
  • Web3 protocols paying keepers, data providers, and other agents.
  • Agent platforms that need reusable privacy and spending controls.

What is next

Our next step is to integrate the encrypted-policy-limit path completely into the primary browser experience, reduce confidential-transfer latency, deploy production-grade RPC infrastructure, and conduct pilots with treasury and procurement users.

Longer term, Agacy can become a reusable wallet-level privacy and authority layer for different AI frameworks, agents, and on-chain applications.

Built With

  • aes-gcm
  • agent
  • ai
  • aipay
  • aisa
  • anchor
  • api
  • crypto
  • devnet
  • jupiter
  • kit
  • next.js
  • openai
  • proofs
  • react
  • rust
  • sdk
  • solana
  • tavily
  • token-2022
  • typescript
  • vercel
  • web
  • webassembly
  • zero-knowledge
Share this project:

Updates

Submission history