Helm is the security layer for autonomous agents on Solana. Where multisig was built for humans, Helm is built for agents — programmable policy, tiered execution, and human-in-the-loop veto.
An autonomous agent needs on-chain authority. Hand it an unrestricted private key and you've handed it the keys to the vault. Wrap it in a human-driven multisig and you've broken its latency budget on the first trade.
Helm sits between the agent and the chain. Every transaction passes through programmable policy: whitelisted programs, USD-denominated caps via Pyth, hourly limits, an optional off-chain validator, and a human guardian with last-word veto.
Three execution tiers — instant, timelocked, and manual. Real-time when the policy allows, human-checked when it doesn't.
A jailbroken model. A leaked key. A prompt injection. The agent has unrestricted authority — by the time you wake up, the wallet is empty.
Squads and Goki ship for human approval cycles. Trading agents work in milliseconds. The two latencies don't compose.
"Our agent has spending limits." Where? In a SaaS dashboard you don't own. The policy isn't enforced — it's claimed.
Most setups don't record rejected proposals. A compromised agent can probe limits silently, learning where the rails are without leaving evidence.
Small transfers to whitelisted programs, under per-tx and hourly USD caps, execute inline in the same instruction. Sub-second. The agent never waits.
Larger transactions queue as on-chain pending PDAs. The guardian has a configurable window to veto. After the timelock expires, anyone can execute. The agent moves; the human can intercept.
Forbidden programs, non-allowlisted tokens, hourly cap exhaustion — all rejected outright. Ambiguous cases require explicit guardian approval before they can execute.
Run a market-making or arbitrage agent without trusting it with the full treasury. Set hourly caps in USD. Whitelist the DEX programs you actually use. Veto anything that looks wrong.
Delegate operational spending to a programmatic agent — subscriptions, contributor payments, recurring grants — under transparent on-chain policy. Multisig signers veto only when something deviates.
Building an agent product? Don't ship your own custody. Wrap user wallets in Helm vaults, expose proven primitives, give your users a security model they understand.
Running an experimental agent on your own funds? Configure a strict policy, fund a vault, and let the agent operate inside boundaries you set. Mistakes hit caps, not principal.
The current binary is deployed to Solana devnet. SDK, hello-agent, and guardian CLI all run end-to-end against it. Not deployed to mainnet. Not audited. For testing and research only.
Three weeks ago this was a spec. Today it runs on devnet, end-to-end. Open source, pseudonymous, auditable.