Bursar

Bursar is an on-chain control layer for agent spending. @robinhoodapp Principals set private budgets, counterparties and payment rules. Each transaction is checked against its mandate at settlement. Stealth wallets and ZK proofs protect details while providers verify auth.

Bursar draws a hard line between entering the system and operating inside it. ScreeningGate handles funding at the boundary. After that, the shielded pool and private mandate rules handle execution. Compliance is checked at entry without making every later action public.

The agent interface is deliberately small. agent.pay(url, options) agent.hire(spec) agent.buy(asset, usd) Bursar checks the mandate and returns a settled receipt or a mandate violation. The agent does not need to understand the entire settlement stack.

We've listened community feedback. Telegram Community where you can talk directly with dev is now live: t.me/bursaronrobinhood Join us!

Bursar is the first private, RWA funded spending mandate layer for AI agents on @RobinhoodApp Chain, giving them controlled budgets, approved spending rules and private settlement.

What is Bursar?

Write. Amend. Revoke. Inspect. Bursar keeps these actions in the control plane, but every authority changing action is signed by the principal. The interface can make mandate management simple without becoming the owner of the mandate itself.

Markets do not stop moving because the normal operating window has ended. Bursar includes after hours conditions in collateral health checks. If a position weakens during that period, the system can identify the change and follow the liquidation state machine instead of waiting for a manual review.

What the provider receives A proof that the payment is authorised. A settlement result. No access to the principal’s identity. No view of the full mandate. No public spending history. Bursar keeps the provider confident without making the agent’s financial context public. built on @RobinhoodApp

When one agent hires another through Bursar, the payment follows a clear path. Lock the funds. Deliver the work. Release the payment. Open a dispute if the agreement fails. The money does not move just because one agent says the job is done.

A public mandate would reveal more than an agent needs to reveal. Bursar stores the commitment, expiry and funding lane onchain. The detailed terms stay in the principal’s viewing key space, so the network can enforce the mandate without publishing the strategy behind it.

A resolver should not receive a private mandate just because a payment was disputed. Bursar disclosure grant is scoped to the case. It reveals the slice needed for review, while the rest of the principal’s terms remain in the viewing key space. soon on @RobinhoodApp

The agent is idle. The mandate should not be. Bursar parks approved funding in treasury token notes, watches raw NAV and schedules an unpark when settlement needs cash. The budget keeps working without giving the agent unrestricted access to the parked position.

For a collateralized mandate, Bursar tracks more than what was deposited. raw asset value × price multiplier × haircut ÷ debt That health calculation decides whether credit remains safe and whether the liquidation path needs to act.

A payment can be private without being uncheckable. Bursar WithinMandateProof checks the cap, spend class and counterparty against committed mandate data. The provider receives a yes or no result, not the budget and strategy behind it. built on @RobinhoodApp

A reputation score without its events is just a number on a dashboard. Bursar reputation indexer follows trust events and updates an agent standing from recorded activity. That result can feed mandate limits without inventing a history after the fact.

An RWA ticker is not enough for an agent to know what it is allowed to buy. Bursar canonical registry is the source of truth for eligible assets. If a token is missing or removed, the router treats it as unavailable and the mandate cannot turn a listing into permission.

When an agent reputation changes, the reason should not disappear into a database update. Bursar trust event stream keeps those changes replayable. A service can reconstruct how an agent reached its current standing instead of trusting an opaque score. soon on @RobinhoodApp

If a collateral position weakens, selling everything is the lazy solution. Bursar liquidation path uses a Dutch auction and targets only the slice needed to restore health. The agent does not lose an entire position to fix a smaller shortfall.

Agent to agent work needs a state machine, not a handshake. Bursar locks the payment, waits for delivery, releases when the agreement is met, or marks the job disputed. A bonded resolver quorum handles the exception instead of leaving the funds in limbo.

Privacy, screening and solvency checks all matter. None of them should turn the system into a one way door. Bursar rules keep exit ungated. The protocol can verify what enters and what happens inside without making withdrawal depend on an operator permission. built on @RobinhoodApp