A model that acts
An ordinary model answers a question. An agentic one is given a goal, a set of tools (a search, a file, a shell command, an API) and permission to use them, and it loops: it calls a tool, reads the result, decides the next step. The acting makes it agentic.
Nothing about it is new in kind: a program has always been able to call an API. What is new is that the choice of call is made by a model reading text, so it can handle work nobody wrote a rule for, and be wrong where a rule cannot.
Two questions describe any such system: which tools it holds, and what it may do without asking.
Where it is used
- Writing and running code, then reading the error it caused and trying again.
- Reading and sorting documents: pulling figures out of them, filling a form, filing a record where it belongs.
- Operating software through its API: a ticket moved, a message sent, a reservation made, an order placed.
- Watching something and acting when a condition it was told to watch for is met.
The shape is the same every time: a goal in words, a set of tools, a loop, and a stopping rule. The difference between a useful agent and a dangerous one is almost never the model; it is what was put within reach.
What can go wrong when it handles money
- It can misread, or state what it never read. A figure off by a decimal point is a position ten times too large, and a model asked for a number will give one.
- It can be instructed by the data it reads. Text fetched from outside can carry instructions, and a model that takes them as its own will follow them.
- It can loop, and loops cost. A step repeated is a fee repeated, and on an order book a repeated order is a position nobody intended.
- Its key can be stolen. A key on a machine that runs unattended is a key an attacker can reach, and a key that moves money is then money moved.
What bounds it
Three kinds of bound exist, and they are not interchangeable. Confusing them is how a system ends up protected by the weakest alone.
| The bound | What it is | What it cannot do |
|---|---|---|
| A key with limited power | A credential the venue itself restricts: it signs some actions and the rest are refused on arrival. | Stop a bad action among the ones it is allowed to sign. |
| Limits | A maximum per action and per day, a list of allowed markets, a budget for the model itself. | Hold, if they live in a file that anyone reaching the machine can edit. |
| A mandate | The same limits, signed by the person on a device the machine cannot reach, and checked by code before every action. | Know whether the plan it allows is a good one. |
A journal is not a bound, but without one no bound can be checked after the fact. The order of strength matters: what the venue refuses is strongest, a signed limit comes next, and a configuration file is weakest, because whoever reaches the machine reaches the file.
Two keys and a mandate
Locker Protocol Agentic applies the three this way. Two keys exist, and they are not the same thing. The account key stays in your wallet, Locker Vault on an offline phone first, or the extension or mobile wallet you chose, and can do everything: withdraw, send, approve an agent, sign a mandate. The agent key lives on the computer, sealed under a password, and may only place and cancel orders and set a market's leverage and margin.
The mandate holds the limits signed with your wallet: the largest order, the highest leverage, the markets, the orders a day, the notional opened a day, the uses allowed, the fee rate and its one recipient, and a date, the agent key's own end at the latest, 180 days at most. A guardian applies the narrower of the mandate and the local policy, and checks its signature before every opening.
The agent key is approved by the account on Hyperliquid for at most 180 days, the ceiling Hyperliquid allows, and can be revoked from your wallet. The mandate's shorter term brings you back to your wallet once a month, so no month of trading passes without the limits being read again.
What the measure of 28 September says
The claim that an approved agent key can only trade was tested rather than assumed. On 28 September 2026, on mainnet, a test account approved a fresh agent for an hour, and the agent signed each fund action for 1,000 USDC against a balance of about 60: nothing could move, so only the refusal counted.
Refused on the signer: withdraw3, usdSend, spotSend, sendAsset, usdClassTransfer, approving a second agent, approving a builder fee. Accepted: placing and cancelling an order. And one accepted that should not have been: vaultTransfer, with which 5 USDC signed by the agent key reached a Hyperliquid vault.
An agent key cannot take money out, but it can deposit the account into a Hyperliquid vault, including one an attacker runs. lpa never signs that action: its guardian signs a closed list of trading actions. But a thief with the key file and its password does not need lpa. The largest loss possible is what sits in the dedicated account.