Answered from live records · 2026-09-15
What stops an agent from making a swap it should not?
A policy the owner writes, enforced server-side after routing and before anything is built: caps, allowlists, slippage and deadline ceilings, and what a non-go verdict does, as of 2026-09-15.
Every control a Sato Swap policy carries, and where it lives. None of it is advice to a model: it runs in code the agent cannot reach, which is the only place a limit survives a persuasive message. A refusal always names the rule, the limit and the value read, so an operator can see it was their own rule and not ours.
| Control | The field, and what it does |
|---|---|
| Per-trade ceiling | max_per_trade, base units per token. The default policy sets 1000000000000000000 base units of the input token, and states it — a default nobody chose would otherwise be an unbounded one. |
| Per-period ceiling | max_per_period over an hour, day, week or month. Unset by default. |
| Notional ceiling | max_usd_per_trade, and it only bites when the requester supplied a price it already held. Sato Swap never prices a token, and an unknown notional stays unknown rather than resolving to zero. |
| Chain, token, venue and recipient allowlists | Named lists. An EMPTY list means any, subject to the verdict — an operator who has listed nothing has not thereby refused everything. |
| Slippage and deadline ceilings | max_slippage_bps and max_deadline_s. A breach names the rule, the limit and the observed value, under slippage_over_max or deadline_over_max. |
| What a non-go verdict does | unknown_verdict defaults to refuse; caution_verdict defaults to allow; a no is always a refusal and is stated as a constant rather than offered as a setting. |
| Counterparty requirement | require_passport, FALSE by default. A recipient with no Agent Passport is no record, not a finding against it. When an operator turns it on, the refusal says it was their rule. |
| Mode restriction | allowed_modes. An operator can permit recommend and withhold build-tx entirely, so an agent may ask what to do without ever being handed something signable. |
| Expiry and revocation | expires_at and revoked_at. Past either, the policy refuses — it does not fall back to something looser. |
| Where it runs | lib/swap/policy.ts, server-side, after the venue is chosen and before anything is built. Not in a prompt: a limit that lives in a prompt is a limit a message can argue with. |
How this was answered
Every field of swapPolicySchema in lib/swap/policy.ts, with the rule id each one refuses under. The policy is evaluated server-side after the venue is chosen and before anything is built, so it is not reachable from the model's context.
Every answer on this page is produced by one named function over Sato Hub's live records on the date shown. Nothing is typed by hand, no figure is carried over from a previous day, and an answer with nothing behind it says unknown rather than zero. The Sato Score measures how open, active and verifiable a project is — it is not a safety, quality or returns grade.
Go deeper
More questions
Sources — the projects' own repositories and docs
Cite this page
Sato Hub. "What stops an agent from making a swap it should not?." Sato Hub, updated 2026-09-15, accessed 2026-09-16. https://satohub.ai/answers/what-stops-an-agent-from-making-a-swap-it-should-notData last refreshed 2026-09-15; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0 and the machine-readable copy is linked in the page's Dataset metadata.