AI agents need wallets. They also need a kill switch.

AI agents are getting wallets. Most of the guardrails around them are theater.

The common setup: an agent holds a key, and some off-chain middleware decides what it’s allowed to spend. But middleware is a suggestion. If the agent (or whoever prompt-injected it) can route around the middleware, the limits never really existed.

Put the policy where the funds are

Maestro enforces spending rules in the Solana program that holds the vault. Program, recipient, amount, timing, session: all checked on-chain, on every transaction. The owner can freeze or revoke at any time. An agent can be fully tricked and still can’t move funds outside its policy.

It’s unaudited and devnet-first today. But the shape is right: guardrails belong on-chain, not in a wrapper you have to trust.