Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.dzap.io/llms.txt

Use this file to discover all available pages before exploring further.

AI in DeFi is only useful if it can be trusted not to do something spectacularly stupid with real assets.

​
Core principle

Reasoning and execution should not be treated as the same thing. A model may understand what a user wants. That does not mean it should be free to execute it without structured checks.

​
Execution classes

ClassExamplesTypical confirmation
Readbalances, prices, positionsnone
Advisoryroutes, suggestions, analysisnone
Buildroute building, transaction assemblylow
Simulatedry-run executionlow
Executeswap, bridge, deposit, zapexplicit
Privilegedapprovals, policy changes, high-impact actionsstrict
Every DZap tool falls into one of these classes. Execute and Privileged tools require user confirmation by default — see ZapBot Safety.

​
Pre-execution checks

Before any execute-class action, the runtime evaluates:
  • Token and chain correctness
  • Route sanity
  • Slippage constraints
  • Approval and allowance state
  • Gas reasonability
  • Simulation success
  • Risk flags + policy boundaries
Failure of any check stops the action and surfaces a structured error.

​
Safe execution pipeline

Intent
   ↓
Select tools
   ↓
Build
   ↓
Validate    ← reject on missing fields, bad chain, etc.
   ↓
Simulate    ← reject if simulation reverts
   ↓
Confirm     ← user approval, where required
   ↓
Execute
   ↓
Record + monitor

​
Runtime responsibilities

A production-grade runtime owns:
  • Session lifecycle
  • Wallet context
  • Auth boundaries
  • Permission tiers
  • Signing controls
  • Policy enforcement
  • Scheduling context
  • Audit logs
DZap’s runtime in the SDK and CLI implements these defaults. For embedded agents in third-party products, you’ll add product-specific layers (per-user limits, multi-sig confirmation, …).

​
What’s available today vs. gated

​
Available today

  • Read-class tools, Advisory tools, Build tools — no confirmation.
  • Execute-class tools — with confirmation in CLI/SDK-AI; visible in MCP-aware clients.
  • Session-scoped key handling.

​
Gated by policy or rollout

  • Privileged tools (admin, multi-tenant policy) — partner-only for now.
  • Cross-application policy bundles — in design.
For the security model and threat boundaries, see Security & Audits and ZapBot Safety.