The real lesson here is that the LLM shouldn't be the "boss" of the money; it should just be the decision-maker. The actual security lies in the wrapper.
The Architecture #
I spent a while assembling this on Devnet, and the stack essentially boils down to a loop where the LLM suggests an action, but a rigid policy engine decides if that action is actually allowed to execute.
Agent Loop: The reasoning engine that determines which tool to trigger.This is where I exposed the blockchain tools via Model Context Protocol to keep them reusable.MCPServer:Policy Engine: The most critical part. It's a "deny-by-default" layer. If the transfer isn't on the allowlist, it doesn't happen, regardless of how "convinced" the LLM is.Solana Devnet: The final execution layer.
Technical Breakdown of Tools #
For those looking for a practical tutorial on how to structure these tools, here is the logic I used. The agent interacts with these via JSON.
Read-only Tool: get_balance
This is a safe, zero-side-effect call.
{
"address": "string",
"lamports": number
}
Write Tool: transfer_sol
This is the high-risk tool. It must be wrapped in the policy engine.
{
"recipient": "string",
"amount": number
}
The return isn't just a success/fail; it specifically handles policy denials:
{
"status": "denied",
"reason": "Recipient is not on the allowlist"
}
The Prompt Logic #
To make this work without the agent hallucinating its own permissions, I used a system prompt that forces it to acknowledge the policy engine as the final authority.
You are a Solana On-Chain Agent. Your goal is to manage funds on Devnet based on user instructions.
Available Tools:
1. get_balance(address): Returns the SOL balance of a wallet.
2. transfer_sol(recipient, amount): Moves SOL to a recipient.
Constraints:
- Every transfer request is filtered through a Policy Engine.
- If a transfer is "denied", do not attempt to bypass it; report the specific reason to the user.
- Always verify the balance using get_balance before attempting a transfer.
Workflow:
Reasoning -> Tool Call -> Policy Check -> Execution -> Result
The AI only makes the decision; the policy engine provides the safety. If you're building an LLM agent, stop trusting the prompt to handle security and start building a hard-coded validation layer.
Next Prompt Quality: The Token-to-Instruction Ratio →