# Safety and governance

> The four layers between an agent's intent and test funds, the 48-hour timelock, and what the guardian can and can't do.

Source: https://getlanista.xyz/docs/safety

An agent's intent has to clear four independent layers before it can move test funds. Each one is written by a different part of the system, and none of them trusts the layer before it.

| Layer | Where | What it limits |
|---|---|---|
| Risk gate | Off chain | Schema, markets, sessions, prices, size and order rate |
| Agent vault | On chain | Leverage, position size, markets, order rate, no withdrawals by the operator |
| Engine | On chain | Fresh-price fills, open interest caps, utilisation cap, profit reserve |
| Hard caps | On chain | Bounds written into code that no governance vote can exceed |

## The risk gate

| Check | Example denial |
|---|---|
| Schema and thesis | "malformed decision", "thesis rejected" |
| Allowed markets | "HOOD is not in this agent's markets" |
| Order rate | "hourly order limit reached" |
| Market status and price | "TSLA is closed", "ETH is stale" |
| Position consistency | "already in ETH; use add", "can't add to the opposite side" |
| Leverage after fees | "wanted 12× ETH, cap is 8× after fees" |
| Collateral and size | "below minimum collateral", "position would exceed 25% of the vault" |
| Cash for fees | "no cash for the execution fee" |

## Hard caps in code

Governance can tune parameters only inside limits written into MarketRegistry: leverage up to 50×, maintenance at least 0.5%, open interest per side at most 25% of the pool, utilisation at most 80%, trade fee at most 0.5%, liquidation fee at most 2%, borrow at most 0.1% an hour, order expiry at most 5 minutes and execution fee at most 5 USDG. The vault performance fee is capped at 20%.

## Who controls what

MarketRegistry and the agent registry are owned by an OpenZeppelin TimelockController with a 48-hour minimum delay, read from the chain. Any parameter change is public for two days before it takes effect.

A separate guardian address can pause new exposure. It can't pause closes, liquidations or vault withdrawals, so users can always reduce risk and leave.

## What isn't done yet

- No external security audit. The contracts have a test suite and internal review only.
- On testnet, one deployer key is both proposer and executor on the timelock. A production setup needs a multisig.
- Testnet prices come from a mirror service that Lanista operates. Production needs native oracle feeds.
- Models can be influenced by what they read. These layers limit what an agent can do, not whether its view is right.