---
title: "Agentic finance: how AI agents work with Lagoon vaults"
description: "Agentic finance is moving from chat to capital. In this article we describe how Lagoon vaults let AI agents discover, read, and act onchain, with the guardrails set by a human."
date: "2026-07-27"
author: "Lagoon"
category: "Product"
tags: ["agentic finance", "AI agents", "MCP", "vaults", "ERC-7540", "onchain asset management"]
url: "https://lagoon.finance/blog/agentic-finance-lagoon-vaults"
readingTime: "11 min read"
---
AI agents are starting to move capital, not just answer questions. To work with an onchain vault, an agent must discover it, read its live state, and act on it. Lagoon vaults offer all three, and their role structure lets a manager delegate strategy to an agent without surrendering custody, valuation, or access.
## Introduction
For two years, AI in finance raised one interesting question: what could a model tell you? In 2026 the question shifted to what an agent can do on your behalf. Autonomous agents now hold identities, funds, and settle payments between themselves: the x402 payment standard, backed by Visa, Mastercard, and Circle, [processed roughly 75 million agent transactions](https://www.coindesk.com/tech/2026/07/15/visa-mastercard-and-ripple-join-the-standard-letting-ai-agents-pay-in-stablecoins) in a single 30-day window this summer.
Asset management is watching this closely, and warily. An agent that can move capital is useful. An agent that can move capital without limits is a liability. A Lagoon vault is an onchain contract, legible to software by default. Its roles are separable: a manager can let an agent run a strategy while the contract enforces the boundaries. That combination, open to machines but controlled by design, is what agentic finance needs.
## What agentic finance actually means
Agentic finance is not one product. It is a stack of standards that let software act, not just describe. The vocabulary matured fast over the past year, and most of it now maps cleanly onto machinery that traditional finance already understands.
| Agent rail | What it does | Traditional-finance analogue |
| ---------- | ----------------------------------------------- | ------------------------------- |
| MCP | Connects an agent to live data and tools | Market data terminal plus APIs |
| A2A | Lets agents delegate to each other across firms | Interbank messaging |
| x402 | Lets agents pay in stablecoins | Payment and settlement rails |
| ERC-8004 | Gives agents onchain identity and reputation | Know-your-customer registries |
These are not slideware. The Model Context Protocol (MCP), the standard for connecting an assistant to live data, passed 10,000 public servers and tens of millions of monthly downloads by the end of 2025. The Agent-to-Agent (A2A) protocol is in production at more than 150 organizations. ERC-8004, which gives agents onchain identity and reputation, reached reference deployments on Ethereum mainnet in January 2026, with tens of thousands of agents registered within weeks.
The numbers are small, and the limits are deliberate. Re7 Capital, an institutional allocator, put $500,000 into Giza's ARMA yield agent using non-custodial smart accounts with revocable session keys: time-limited permissions that define exactly which functions the agent may call and cap what it can move. The capability ceiling is real, too. Agents reliably improve yield routing, but they still lag human traders on autonomous directional trading. So the shape of agentic finance in 2026 is focused optimization and treasury automation with guardrails, not hands-off fund management. That is the frame institutions should build for.
## What an agent needs from a vault: discover, read, act
An agent approaching a vault follows the same loop a human would, only every step has to be machine-addressable. It has to find the vault and understand what it is. It has to read the vault's live state. And, if it is going to do anything, it has to act on the vault onchain.
_Figure 1: the same loop a human follows, open to machines._
**Discover.** Before an agent can use a vault, it has to know the vault exists and what it offers, without scraping a marketing page. Lagoon publishes that description in machine-readable form: an llms.txt index, an A2A agent card, and an MCP server card, plus content negotiation that returns structured data to any client. The wider debate about llms.txt has focused on search rankings, where its impact is negligible. That misses the main point: the agentic layer, where a program acting for a user needs a structured fact sheet rather than a web page.
**Read.** Reading tells an agent how the vault is doing. Lagoon serves a public GraphQL API at `api.lagoon.finance/query` with no key, and an MCP server that answers questions about any vault in plain English. Both sit on top of the same indexed onchain data, so an agent can pull performance history, asset composition, and net asset value (NAV) over time, then reconcile every figure against the chain. This is the same data layer developers use, described in more detail in [Lagoon's open data layer](/blog/lagoon-api-sdk-mcp).
**Act.** Acting is where a vault has to be built for it. Because a Lagoon vault is an [ERC-7540 contract](/blog/erc-7540-explained), an agent can transact against it directly: request a deposit, request a redemption, or settle. The open-source TypeScript SDK, built on viem, reads and writes those contracts without a Lagoon server in the path. The vault is programmable and permissionless, so the act step is an onchain transaction like any other, not a private integration an agent has to be granted.
## Autonomy needs guardrails
The reason institutions hesitate is not that agents are useless. It is that autonomy without limits is unauditable and unsafe. Regulators have already named the concern. FINRA's 2026 oversight report flags three novel risks specific to autonomous agents: autonomy itself, scope creep (an agent exceeding its intended authority), and auditability. The EU AI Act reaches full enforcement for high-risk systems in August 2026, and it requires human oversight. An agent you cannot bind or audit should not be deploying capital.
A Lagoon vault answers that concern structurally, not with a promise. Its [governance roles](/blog/vault-governance-roles) are separable, and the curator role (the vault's equivalent of a portfolio manager) is nothing more than an address. Anything that can sign can hold it: a human team, a multisig, or an autonomous agent. Delegating strategy to an agent is not a special integration we had to build; the role was designed from the outset to be held by a different kind of signer. The same holds for the other roles, which can sit with people or with other agents and remain outside the curator's reach. How governance and guardrails are configured is always the deployer's choice.
_Figure 2: a manager can hand the strategy to an agent while custody, valuation, access, and hard caps stay enforced onchain._
Lagoon implements separation of duties at contract level, because that is how responsible finance works.
- **Custody stays separate.** Vault assets sit in a Safe, a multisig or multi-party computation (MPC) wallet. The curator directs trades, but doesn't have to hold the private keys of the custody. Thus, an agent can decide and execute the trades within parameters set by a human and never hold the keys ie custody of the assets. This mirrors the non-custodial pattern institutions already ask for, covered in [onchain fund custody](/blog/onchain-fund-custody).
- **Valuation stays separate.** Pricing comes from Lagoon's NAV computation engine on a scheduled, deterministic basis, independent of whoever holds the curator role. Prices then pass through price-per-share (PPS) guardrails at every settlement, and a Security Council scoped only to those bounds can reject a non-compliant valuation. A mispriced NAV cannot mint or burn shares, whatever the agent submits.
- **Access stays separate.** A whitelist manager controls who can deposit, and a Chainalysis oracle blocks sanctioned addresses from interacting with the vault at all. The agent running the strategy has no say over the investor set or the vault's compliance posture.
- **Emergency powers stay human.** A superoperator role can freeze user funds if something goes wrong. It sits outside the curator role, so an agent cannot disable the brake that stops it.
- **Limits are hard-coded.** Entry and exit fees are capped at 2% in the contract and can only fall after launch. A per-vault capacity cap bounds total deposits. These are enforced onchain, so no role, agent or human, can breach them.
There is a second benefit, and it speaks to the auditability that FINRA singles out. Every action an agent takes against the vault is an onchain transaction: timestamped, attributable, and permanent. The multi-step reasoning of an agent may be hard to trace, but its effects on the vault are a complete public ledger. For an institution, that is the difference between trusting a black box and supervising one.
## Scoping what an agent can sign
Separating roles bounds what the curator address can do to the vault. A second boundary sits one layer down, around the address itself. An agent is never handed a private key it can use freely. It receives a narrow permission to propose specific calls, and the infrastructure refuses everything else. Two setups are in use today.
_Figure 3: the agent proposes; a policy engine or a smart contract decides what is allowed to sign._
The first makes the curator address an MPC wallet, such as Fireblocks, Fordefi, or Blockdaemon, where a policy engine holds the mandate. Policies whitelist contracts, methods, amounts, and counterparties, and anything outside them is refused at signing. The key material stays sharded inside the provider, so the agent submits an intent through an API user and never holds a key at all.
The second keeps the curator address as a Safe multisig owned by the institution, with the [Zodiac Roles Modifier](https://docs.roles.gnosisguild.org/) granting the agent's address a scoped execution role. The scope reaches down to specific contracts, functions, and argument values, so an agent cleared to supply one lending market cannot call the same function on another. The Safe re-scopes or revokes that role at any time, which keeps a human quorum in ultimate control and lets a manager withdraw the mandate without migrating the vault.
Either way the mandate lives in a policy engine or a smart contract rather than a service agreement, and it fails closed. An agent that strays outside its scope is not corrected after the fact. The transaction is simply never signed.
- **Agentic finance is already in action:** the 2026 shift is from models that describe strategies to agents that execute them, built on standards like MCP, A2A, x402, and ERC-8004.
- **An agent needs three things from a vault:** to discover it, read its live state, and act on it. Lagoon exposes all three through machine-readable files, a public API and MCP server, and programmable ERC-7540 contracts.
- **Deployed reality is bounded:** in 2026, agent-managed capital is yield optimization and treasury automation within guardrails, not autonomous fund management. Lagoon is uniquely suited for this usecase.
- **Autonomy is made safe by separation, not trust:** the curator role is just an address, so an agent can hold it while custody, valuation, access, and fee caps stay enforced onchain by a human. Scoped keys, whether an MPC policy engine or a Safe with the Zodiac Roles Modifier, bound what that address can sign at all.
- **Onchain settles auditability:** every agent action against a vault is a timestamped onchain transaction, which is exactly the traceability regulators are asking for.
Explore the Lagoon docs to see the SDK, public API, and MCP surface an agent reads and acts on, or query api.lagoon.finance/query directly to read live vault data yourself.
## Going further
- **The code:** the [Lagoon SDK](https://github.com/hopperlabsxyz/sdk-v0) and the [Lagoon MCP server](https://github.com/hopperlabsxyz/lagoon-mcp), both open source, are the surfaces an agent builds on.
- [More than vaults: Lagoon's open data layer](/blog/lagoon-api-sdk-mcp): the SDK, API, and MCP server an agent reads through, in depth.
- [Lagoon v0.6 is live: security, autonomy, and modularity](/blog/lagoon-smart-contracts-v0-6-preview): the PPS guardrails, Security Council, and caps that bound a delegated role.
- [Vault governance roles: who does what in an onchain fund](/blog/vault-governance-roles): the separable four-role model that makes delegation safe.