Trick the agent all you want. The vault does not care.

Assume your agent will be prompt-injected. Not “might be”: will be. An agent that reads the internet takes instructions from the internet, and no system prompt fully prevents that. The question is not how to build an agent that cannot be tricked. It is how to build a wallet where a fully tricked agent still cannot do damage.

Middleware is a suggestion

The common guardrail setup puts a policy layer between the agent and the chain: some off-chain service that approves or rejects what the agent wants to do. But if the agent holds the key, the middleware is advisory. Anything that steers the agent (a poisoned webpage, a malicious tool result, a jailbreak) can steer it around the wrapper. The limits never really existed.

Ten checks between the agent and the money

Maestro puts the policy in the Solana program that holds the vault. Every action the agent attempts passes through a ten-step check chain, on-chain, on every transaction:

1. Is the vault frozen? The owner’s kill switch, checked first.
2. Is the session key valid? Agent identity, nonce, expiry window, revocation.
3. Are we inside operating hours?
4. Has the cooldown elapsed since the last action?
5. Is the target program blacklisted?
6. Is the target program greenlisted? No entry, no call.
7. Do the token and recipient pass the blacklist, greenlist, and whitelist checks?
8. Are we inside the USDC limits? Per-transaction, daily, and per-session.
9. Only then does the program execute the call, signing from the vault.
10. And it emits an event, so every action leaves a receipt.

Notice what is absent from that list: the agent’s intentions. The chain does not care why the agent is acting. A perfectly aligned agent and a fully hijacked one hit the same wall.

What an attacker still gets

Honesty about the residual: an injected agent can still burn its allowance. Inside operating hours it can spend up to the per-transaction and daily limits, at greenlisted programs, to allowed recipients. Policy bounds the blast radius; it does not make the blast radius zero. That is the trade, and it is a much better trade than trusting a wrapper.

Maestro is unaudited and devnet-first, and I say so on the tin. But the shape is the point: guardrails belong in the program that holds the funds, where a tricked mind cannot vote them away.