The treasury that reconciles itself before it pays.

Overview

Thesauros is an AI-operated business treasury on Arc, Circle’s stablecoin-native chain. You write a plain-English mandate. Thesauros compiles it into a machine policy, which you review and sign. From then on an agent keeps idle USDC productive, pays the recipients you approved on schedule, and screens every counterparty continuously, but only inside the rules you signed.

The design principle is simple: reasoning proposes, deterministic code disposes. A model can suggest an action. It can never move funds by itself.

How it works

Every action the agent takes follows the same pipeline. Each step can stop it.

1. 1Gather. Plain code collects balances, due payments, prices and risk signals into a snapshot. The model never fetches its own data.
2. 2Propose. The reasoning layer suggests at most one action, or none. It has no tool that can sign or send.
3. 3Check. The Policy Engine runs the rules below. It is a pure function: no network, no clock, no randomness. The outcome is allow, ask you, or deny, and deny wins over ask, and ask wins over allow.
4. 4Simulate. The transaction is dry-run and the balance changes must match the proposal exactly.
5. 5Receipt. Only an allow produces a single-use, short-lived receipt.
6. 6Execute and confirm. One executor, and only it, holds the ability to act, and only with a valid receipt. Confirmation is read back from the chain.

Quick start

About fifteen minutes. Everything below runs on Arc testnet with free test USDC.

1. 1Connect. Open the app and connect a browser wallet such as MetaMask. Signing in moves no money. If your wallet is on the wrong network, approve the switch to Arc Testnet.
2. 2Create your agent wallet. Setup creates a separate wallet for the agent. It is not your own wallet, and the agent can only spend what you put in it.
3. 3Write your mandate. Describe your limits and payments in plain sentences, then compile it and read the numbers it shows you.
4. 4Add recipients. Add each person with their wallet address and sign each one.
5. 5Sign the policy. Your signature makes the compiled policy the only rulebook the agent can follow.
6. 6Fund the agent wallet. Copy its address from the dashboard and request test USDC from the Circle faucet (choose Arc Testnet).
7. 7Watch it work. The agent checks the treasury on its own schedule. Open Activity to see each decision and the rules it passed.

How to draft a mandate

A mandate is a few plain sentences that tell Thesauros how careful to be with your money. You do not need any technical knowledge. Thesauros turns your sentences into exact numbers and shows them to you, and nothing runs until you sign.

The five sentences every mandate needs

1. 1Cash buffer. “Keep 20 USDC liquid.” This much always stays put and the agent will never move it. Think of it as your emergency cash.
2. 2Per-transaction limit. “The agent may move up to 8 USDC per transaction.” The largest single action it may take without asking you.
3. 3Daily limit. “…and up to 8 USDC per day on its own.” A cap on everything it moves in any 24 hours.
4. 4Approval point. “Ask me for approval before anything over 4 USDC.” Above this, the agent waits for your signature instead of acting.
5. 5Safety triggers. “Use a depeg threshold of 50 bps and a vault drawdown threshold of 100 bps.” These say when the agent should pull money out of a vault. Always include both; a mandate without them will not compile.

“bps” means basis points: 100 bps is 1%. A depeg threshold of 50 bps means “act if USDC drifts 0.5% away from one dollar”.

How to choose your numbers

• Start from how much you would be upset to lose in one go. Make your daily limit that or lower.
• Keep the per-transaction limit at or below the daily limit.
• Set the approval point at or below the per-transaction limit if you want to see every larger move first.
• When in doubt, go smaller. You can edit and sign a new mandate later.

Sample mandates to copy

Press Copy, paste it into the mandate box during onboarding and press Compile. The same four appear as buttons in the app.

Paying people

The mandate sets the limits. Who gets paid, how much and on which day of the month is set when you add each recipient in the next step. A recipient’s own cap cannot be higher than your per-transaction limit, and a recipient that is your own treasury address is refused.

What each number does

If it will not compile

• Check that both safety thresholds are present.
• Check that your numbers follow the order above.
• Read the message under the Compile button, edit the text and compile again. Nothing is saved or moved until you sign.

Guardrails

Twenty-three rules, R00 to R22, run on every proposal. They are ordinary code, not a model, so the same input always gives the same answer. Verdict precedence is DENY > ESCALATE > ALLOW.

System ceilings

Fixed in code and not editable by any mandate. They hold even if the policy asks for more.

Payments and recipients

The agent can only pay people on your signed recipient list. Each recipient has a checksummed address, a chain, an optional per-transaction cap and an optional schedule.

• Exact match only. Destinations must match the allowlist by address and chain. Name lookups and similar-looking addresses are never used.
• Schedules. A day of the month (1 to 28) turns the recipient into a payment that falls due that day and again each month. Once it confirms on-chain it is marked paid.
• Continuous screening. Recipients are re-screened on a schedule. A medium-risk recipient is limited to 10,000 USDC per transaction. A high-risk recipient cannot be paid autonomously and needs your approval.
• Approvals. Anything above your threshold waits in Approvals. Nothing is sent until you sign.

Idle cash and yield

Cash above your buffer can earn yield in an allowlisted vault. On Arc the vault is USYC, Circle’s yield-bearing money-market token. The agent deposits only what is idle and redeems what a cash-flow forecast says will be needed, including a partial redeem when only part is required.

On Arc, USDC is also the gas token, so the agent holds back a small reserve from every deposit and sweep to pay its own transaction fees.

Activity and audit

Activity lists every decision the agent made, including the quiet ones. Open a decision to see the data it saw, what it proposed, each rule that ran and its result, the transaction link and the confirmation.

Under the hood this is an append-only audit log: context snapshots, proposals, verifications, verdicts, executions, approvals, freezes and revocations. A database trigger blocks updates and deletes. A ledger can show that debits equal credits; this log shows why a payment was made, so a reviewer can replay the reasoning, not just the result.

Owner controls

These controls never call the AI layer, so they work even if the reasoning service, the model or the worker is down.

Security model

• Reasoning never touches funds. Only the executor can perform a write action, and only with a valid, unexpired, unused receipt.
• The model gets no write tools. Data gathering is plain code, and nothing that can sign or send is ever passed to a model.
• The policy engine is pure. No network, no model, no clock, no randomness. It is tested against an adversarial corpus of injection and misuse attempts.
• Non-custodial by design. The agent has its own wallet and can only spend what you place there, within your signed limits. Your treasury and keys stay with you.
• Idempotent. Each execution is keyed by its proposal, and each receipt can be used once, so a retry can never double-pay.
• Secrets stay secret. Keys are kept out of logs, prompts and API responses.

Testnet and limits

What this means in practice:

• The first pilot was one small team on testnet. Six scheduled payments totalling 500 test USDC confirmed on-chain and can be checked on the Arc explorer. It is a start, not a claim of scale.
• The live service may take a moment to wake after a period of inactivity.
• Cross-chain payments through CCTP and Gateway, and EURC, are not part of the current release.
• Yield figures in any report are estimates at an assumed rate, not results.

Troubleshooting