Every transfer runs the policy check. A human or an agent, same enforcement.
The AI agent gold rush has a quiet problem when it reaches real-world assets: an autonomous program moving regulated value across jurisdictions is, by definition, a compliance event. Most of the agent field has no compliance layer at all. Onchain Bridges has one on every transfer, on four virtual-machine families, and that changes what an agent can safely do.
Here is the whole idea in one sentence: at Onchain Bridges, an agent is just another address, and it cannot touch a real-world asset unless it has been admitted to the allowlist. The enforcement is free, it is the same allowlist that gates every human transfer. What we are building on top is the binding: an agent acts under a provable mandate from a KYC'd principal (scope, limits, duration), the emerging "Know Your Agent" model. The agent never becomes its own KYC subject; its principal does, once, and the agent inherits that credential under a revocable mandate.
An infrastructure story, not a token story
That is why we think the honest version of "AI agents for RWA" is an infrastructure story, not a token story. An agent acting on real-world assets needs identity and compliance, cross-chain settlement, automation, and best execution. We have all four on testnet today, built on Chainlink CCT and CCIP for the transport layer, and Chainlink ACE for the compliance policies that fire on every transfer. What we are adding is the agent-facing interface and a bounded agent wallet, the two cheapest pieces. When an agent goes to move a tokenized treasury from one chain to another to capture a better loan, the compliance check fires at every hop, exactly as it does for a person. No exceptions, no edge.
The enforcement is free. The credential binding is the build.
How Know-Your-Agent works in practice
The mandate is a signed object the principal creates once and hands to the agent. It has four fields that matter: scope (which contracts the agent may call and which asset classes it may touch), limits (maximum amounts per transaction and per period), duration (when the mandate expires), and a revocation flag the principal can flip at any time to kill the mandate on the spot. The agent presents the mandate at every call. The compliance policy reads it, checks that the principal's underlying credential is still valid, and either lets the call through or reverts with a specific error the agent can log and react to.
Nothing about this is speculative. The principal is a human who verified once with our KYC provider. The credential is portable across four EVM chains, so verifying on one chain is verifying on all of them. The agent's address never becomes a KYC subject; it inherits the principal's credential for the duration of the mandate. If the agent is compromised, the principal revokes the mandate and the agent's address goes back to being what it was before: an address with no standing to move regulated value.
This is the piece the rest of the field is missing. Not the agent runtime, not the model, not the tool-use loop, all of which are being built well by many teams. The missing piece is a durable credential binding that a compliance layer can enforce on every hop, so an autonomous program acting on regulated value is bounded by the same rules a human is. The moment you have that, an agent stops being a policy question and becomes an ordinary participant.
Four families, one enforcement guarantee
The interesting design constraint is that "compliance-at-every-transfer" has to hold on chains that do not share a virtual machine or a compliance primitive. Solana is not EVM. Stellar's Soroban is not EVM. Stacks Clarity is not EVM. Each family gives us a different set of tools to work with. We run the same guarantee across all four families today, enforced by each chain's own native mechanism.
EVM (Sepolia, Amoy, Plume, Minato): a Chainlink ACE ComplianceCheck contract is attached to every OB-issued token. Each transfer calls a modular policy set: an identity validator (does the sender have a valid credential), an allowlist policy (is this address admitted for this asset), and a max-balance policy that caps concentration. The agent address inherits the principal's credential and passes exactly the same modules a human user would. There is no separate path for agents. That is the point of the design.
Solana: Token-2022 transfer hooks let a program run on every SPL transfer of the asset. The hook consults an on-chain compliance registry that mirrors the EVM allowlist state via a Chainlink CRE workflow. Same guarantee, different execution model.
Stellar Soroban: a lock-and-mint bridge locks the asset on the EVM source and mints on Soroban only if the destination address is admitted. Non-admitted mints revert on the Soroban side, not deferred to an off-chain check.
Stacks (Clarity): a Tier-2 asset registry gates each mint. The bridge writes into the registry only when the source EVM chain has confirmed the recipient is admitted, so the enforcement moves with the asset instead of being enforced on the Stacks node's honor.
Four different mechanisms, one behavior. An agent presenting the mandate cannot bypass any of them, because none of them are optional and none of them are OB-run signatures the agent could forge or spoof. Every one runs on the destination chain, and each one is auditable in the chain's own explorer.
What this design does not solve
Two things stay off the chain, on purpose. First, dispute resolution. If the agent takes a real action inside its scope and its principal later disagrees with it, the principal is still the counterparty of record, the same as if they had signed the transaction themselves. The mandate is a preauthorization, not a shield. Legal recourse and consumer protection sit where they always have, in the courts of the principal's jurisdiction. Nothing here changes that, and it should not.
Second, KYC still requires a human at the top of the chain. The mandate cannot mint standing that the principal does not have. If the principal was never admitted for a given asset, the agent inherits nothing, and every call reverts at the policy check. That is the point of the design, not a limit of it. An agent is powerful because it can act on real value at machine speed; the compliance envelope is what keeps that from being reckless.
This is testnet and unaudited, and the autonomous executor is in active development. When it goes live, bounded agent wallets will pay protocol fees in Teleport (TLPT), the network's utility token, the same asset a human user carries. We would rather show you a real testnet flow than promise you a mainnet one. Try the demo: connect a wallet, run the compliance check, and ask the concierge to find and take the best loan for you.
Testnet, unaudited. Not a solicitation. Not an offer of securities. Every transaction you make on this site is signed by your own wallet on a public testnet. No real money moves.
Testnet, unaudited. Not a solicitation. Not an offer of securities. Every transaction you make on this site is signed by your own wallet on a public testnet. No real money moves.