DeFi exposure built for real diligence.

“Delegation is not the opposite of sovereignty. Unbounded delegation is. The question was never whether capital would be managed by someone, it was whether that someone's authority could be enumerated, constrained, and verified by the person bearing the risk.”

Preamble

DeFi has survived its first decade through cycles of euphoria, collapse, and reconstruction. What has emerged is a set of protocols powerful enough to serve as financial infrastructure. What has not emerged is a credible answer to a simpler question: who is accountable when something goes wrong, and what exactly were they permitted to do?

Most capital does not self-manage. It never has. Pension funds, treasuries, family offices, and DAOs delegate to managers, to mandates, to systems. Retail depositors delegate too, whether or not the interface admits it. A vault with an auto-allocating strategy is a delegation. A protocol with an upgradeable proxy is a delegation. Pretending otherwise has not made DeFi safer; it has made the delegations undisclosed.

Bizantine Labs is a curator. We accept discretion over how capital is deployed inside the vaults we operate. This document states the terms on which we believe that discretion is legitimate, and the terms on which it is not.

Three properties determine whether delegated capital is defensible, each expressed in code so each can be verified rather than trusted:

• Agency keeps the curator's authority enumerated and narrower than your exit.
• Autonomy keeps execution running inside constraints committed to before the moment they were needed.
• Safety keeps failure bounded by structure rather than by vigilance.

I. The Stakes

Institutional and treasury capital has largely stayed on the sidelines of onchain yield, and the reason is not unfamiliarity. It is that the questions an allocation committee must answer cannot currently be answered about most DeFi products.

What can the operator do with my capital? Under what conditions? Who decides? What is the failure mode, and what happens on the way down? These are underwriting questions. They are the same questions asked of any external manager.

The gap is not a technology gap. Vault standards, timelocks, permissioned adapters, and onchain accounting are mature enough to express bounded mandates with precision that no traditional manager could match. A traditional fund's investment restrictions live in a side letter. Ours lives onchain.

That is the actual advantage of building here. Capital will flow at scale when curators stop asking for trust and start shipping constraints.

II. Agency: Bounded Authority and Unconditional Exit

What it means

Agency is not the absence of a manager. It is the condition in which every power the manager holds is enumerated in advance, enforced by code rather than policy, and narrower than the depositor's ability to leave.

For a curated vault, that means:

• Enumerated authority. Every action the curator can take is a specific, disclosed function call against a specific, disclosed set of contracts. There is no general-purpose discretion.
• No discretionary control over depositor balances. Curation authority governs where pooled assets may be deployed, subject to caps. It does not extend to redirecting, seizing, or reassigning any depositor's claim on the vault.
• Redemption as a contract right. Withdrawal is a property of the vault, not a service we provide. It does not require our cooperation, our approval, or our continued existence as a firm.
• Change under delay. Material parameter changes (venues, bands, caps, and adapters) are subject to a timelock long enough for a depositor who disagrees to exit before the change takes effect. Exit-before-change is the mechanism that makes delegated discretion consensual on an ongoing basis.

The one exception, stated plainly

We hold emergency powers. They are scoped to pausing vault operations and to the specific claim contracts we operate. A pause can temporarily suspend redemptions. That is a real limitation on exit and we will not describe it away.

What a pause cannot do is change where value goes. It cannot move assets to a destination of our choosing, cannot alter any depositor's share of the vault, and cannot convert a delay into a loss of claim. The power is to stop, not to steer.

Why it matters

Because the alternative to bounded authority is unverifiable authority. Discretion that has not been enumerated has not been surrendered; it has only gone unstated. A power written down can be capped, delayed, or refused. The question is never "would they," but "could they, and how would I know."

III. Autonomy: Execution Within Pre-Committed Constraints

What it means

Autonomy is the capacity of a system to execute continuously, without a human deciding in the moment, inside constraints committed to before the moment arrived.

The distinction that matters is between automating execution and automating judgment. Rebalancing to a target, harvesting a reward, unwinding a position when a health threshold breaks is execution. Deciding to enter a new venue, raise a cap, or take on a new counterparty is judgment. Execution should be autonomous. Judgment should be slow, disclosed, and delayed.

Concretely:

• Strategy runs as programmable logic, not as an operator remembering to act.
• The set of destinations an automated executor may reach is a fixed allowlist. Automation cannot expand its own reachable surface.
• Automated allocation is authorized to move capital toward safety without delay, and toward new risk only within pre-set caps.
• Every automated action produces an auditable record of what triggered it and what constraint permitted it.

On single points of failure

We will not claim there are none. Keeper infrastructure, oracles, and monitoring are concentrations of authority.

What we claim instead is that each concentration is deliberately chosen, disclosed, and blast-radius-limited:

• Separation of powers. The component that decides to act and the component that can veto an action are structurally distinct, so that a compromise of one does not silently become authority over both.
• Fail-safe defaults. When a data source degrades or disagrees with its peers, the system's available action is to halt, not to guess. Uncertainty resolves toward inaction.
• Asset-level containment. A market judged unhealthy is isolated across every vault holding that exposure, rather than handled position by position. Multi-venue automation failures during a depeg are a known pattern; containment must be at the level of the asset, not the individual allocation.

Why it matters

Capital at scale is patient, mandated, and unsupervised by design. No allocator has someone watching a health factor at 3am. Autonomy is what makes an onchain mandate operable, and pre-committed constraints are what make it underwritable.

IV. Safety: Underwritable by Design

What it means

Safety, for a curator, is not the promise that nothing will fail. It is the property that failures are bounded in advance, visible while they happen, and survivable in their expected form.

We hold that a vault is safe to the extent that:

• The failure modes are enumerated before deployment, with the maximum loss each one can produce, given the caps actually set onchain.
• Loss is contained by structure, not vigilance. Per-venue caps, isolated markets, and conservative oracle configuration cap the damage from a bad venue without requiring anyone to notice in time.
• Risk is disclosed at the point of decision, in the terms an underwriter uses: what exposure, to whom, capped at what, priced by what oracle.

The distinction that resolves the paternalism objection

There is a real tension between protecting people and respecting them, and it dissolves along one line: we constrain execution, we do not override choice.

A depositor's decision to accept a strategy's risk profile is theirs. Our job is to ensure the strategy cannot exceed the risk profile it disclosed. Refusing to let automation route into an unvetted venue is not paternalism toward the depositor; it is a constraint on us. Every hard limit in our system binds the curator first.

Why it matters

Every major exploit has cost the ecosystem more in credibility than in capital. The institutional money that watched and decided to wait is the real loss. Safety is the precondition of underwriting, and underwriting is the precondition of scale.

V. Why These Reinforce Each Other

It is often assumed these three properties trade off: that safety costs autonomy, that autonomy costs agency, that agency costs usability. That intuition comes from products where all three are governed by the same discretion. Separate the layers and the tension largely disappears.

• Bounded authority makes automation safe to grant. An executor that can only reach an allowlist can be trusted to act without a human, precisely because its authority is small.
• Automation makes constraints real. A cap enforced by code, checked every block, is stronger than a cap enforced by a manager's intention.
• Timelocked change makes discretion consensual. A depositor who can leave before a mandate changes has consented to the mandate they are currently in, continuously.

A baseline of safety is not an optional tier. Custody arrangements, exit rights, cap enforcement, and halt behavior are properties of the vault and apply to every depositor identically. What varies between vaults is the risk profile, and depositors choose by choosing a vault. Choice operates at the level of mandate, not at the level of whether the floor exists.

VI. What to Demand of Any Curator, Including Us

If you are allocating to a curated vault, these are the questions that separate a mandate from a hope. They apply to Bizantine on the same terms.

On authority

• Enumerate every power the curator holds, at the function level. What contracts? What functions? What caps?
• Can the curator move, freeze, or reassign a depositor's claim?
• What is the timelock on material change, and can a depositor exit within it?

On execution

• What can automation reach, and can it expand that set without a timelocked change?
• What does the system do when an oracle disagrees with its peers?
• Who can trigger a halt, how fast, and does a halt propagate to every vault with the same exposure?

On exposure

• Given the caps, what percentage of NAV does the largest single venue represent?
• How many distinct counterparties or protocols does the vault depend on for redemption to function normally, and which of them is the slowest to unwind?
• What is the least liquid position, and how long does exiting it take at size?

Closing

Yield and liquidity are necessary. They are not what is missing.

What is missing is delegation that can be audited. Systems where the delegated manager's authority is smaller than the depositor's exit, where automation cannot exceed its allowlist, where the failure modes were written down before they occurred, and where every claim in a document like this one can be checked against a contract address.

Agency. Autonomy. Safety.

Constraints on us first.