Security — Kill Switch & Emergency Exit

Heron's security model prioritizes user safety: the agent can be stopped instantly, withdrawal is never blocked, and there are multiple layers of defense.

Kill Switch (`set_paused`)

The vault owner or sentinel can pause the agent at any time:

set_paused(true)
  → Agent cannot execute new allocations
  → Agent cannot deallocate
  → User CAN still withdraw (always)
  → User CAN still emergency_exit (always)

Pausing freezes the agent, never the user.

Emergency Exit

The nuclear option — sweeps ALL deployed capital back to the vault in one transaction:

emergency_exit
  → Redeems all positions from all venues
  → Returns everything to vault idle balance
  → User can withdraw the full amount
  → No keeper, agent, or operator involvement needed

This works even if:

The agent is offline
The backend is down
The operator has disappeared

The user submits this instruction directly from their wallet.

Sentinel Role

The sentinel is a trusted safety watcher that can restrict but never expand:

Action	Sentinel can?
Lower caps	✓ Yes (immediately)
Veto queued venue additions	✓ Yes
Veto queued cap increases	✓ Yes
Pause the agent	✓ Yes
Raise caps	✗ Never
Add venues	✗ Never
Block withdrawal	✗ Never

Defense in Depth

Layer 1: Net-Edge Gate (backend)
  → Agent only acts when profitable after all costs

Layer 2: Merkle Mandate (on-chain)
  → Only pre-authorized venue+instruction pairs can execute

Layer 3: Caps (on-chain)
  → Per-action, epoch, and position limits

Layer 4: Nonce + Expiry (on-chain)
  → No replay, no stale execution

Layer 5: Kill Switch (on-chain)
  → Owner or sentinel pauses instantly

Layer 6: Emergency Exit (on-chain)
  → User sweeps everything out in one tx

Layer 7: TEE Attestation (hardware)
  → Proves code integrity for high-value decisions

Security Properties

Threat	Mitigation
Agent goes rogue	Merkle mandate limits scope; caps limit size; kill switch stops it
Operator disappears	User has direct on-chain withdrawal + emergency exit
Backend compromised	On-chain caps and mandate are the real enforcement
Replay attack	Nonce guard — each instruction ID usable exactly once
Stale execution	Expiry check — instructions expire after a short window
Privilege escalation	Timelock + sentinel veto on any expansion
Market manipulation	Net-Edge gate requires real positive edge after ALL costs

What Can Never Happen

Agent withdraws user funds — executor key has no withdraw authority
Agent exceeds caps — on-chain enforcement, not just backend logic
Agent uses unauthorized venues — Merkle proof verification per instruction
User gets locked out — withdrawal never blocked under any condition
Caps raised without notice — timelock + sentinel veto window

Mandate & Policy x402 Micro-Payments