{"slug": "solana-ai-agent-my-deployment-workflow", "title": "Solana AI Agent: My Deployment Workflow", "summary": "A developer detailed a deployment workflow for a Solana AI agent that uses a policy engine as a deny-by-default security layer, preventing the LLM from executing unauthorized transfers. The architecture separates the LLM's decision-making role from fund execution, with a rigid policy engine validating every transfer against an allowlist before allowing it on Solana Devnet. The developer emphasized that prompts alone cannot secure agent funds and that a hard-coded validation layer is essential.", "body_md": "# Solana AI Agent: My Deployment Workflow\n\nThe real lesson here is that the LLM shouldn't be the \"boss\" of the money; it should just be the decision-maker. The actual security lies in the wrapper.\n\n## The Architecture\n\nI spent a while assembling this on Devnet, and the stack essentially boils down to a loop where the LLM suggests an action, but a rigid policy engine decides if that action is actually allowed to execute.\n\n**Agent Loop:** The reasoning engine that determines which tool to trigger.This is where I exposed the blockchain tools via Model Context Protocol to keep them reusable.[MCP](/en/tags/mcp/)Server:**Policy Engine:** The most critical part. It's a \"deny-by-default\" layer. If the transfer isn't on the allowlist, it doesn't happen, regardless of how \"convinced\" the LLM is.**Solana Devnet:** The final execution layer.\n\n## Technical Breakdown of Tools\n\nFor those looking for a practical tutorial on how to structure these tools, here is the logic I used. The agent interacts with these via JSON.\n\n**Read-only Tool: get_balance**\n\nThis is a safe, zero-side-effect call.\n\n```\n{\n \"address\": \"string\",\n \"lamports\": number\n}\n```\n\n**Write Tool: transfer_sol**\n\nThis is the high-risk tool. It must be wrapped in the policy engine.\n\n```\n{\n \"recipient\": \"string\",\n \"amount\": number\n}\n```\n\nThe return isn't just a success/fail; it specifically handles policy denials:\n\n```\n{\n \"status\": \"denied\",\n \"reason\": \"Recipient is not on the allowlist\"\n}\n```\n\n## The Prompt Logic\n\nTo make this work without the agent hallucinating its own permissions, I used a system prompt that forces it to acknowledge the policy engine as the final authority.\n\n```\nYou are a Solana On-Chain Agent. Your goal is to manage funds on Devnet based on user instructions.\n\nAvailable Tools:\n1. get_balance(address): Returns the SOL balance of a wallet.\n2. transfer_sol(recipient, amount): Moves SOL to a recipient.\n\nConstraints:\n- Every transfer request is filtered through a Policy Engine.\n- If a transfer is \"denied\", do not attempt to bypass it; report the specific reason to the user.\n- Always verify the balance using get_balance before attempting a transfer.\n\nWorkflow:\nReasoning -> Tool Call -> Policy Check -> Execution -> Result\n```\n\nThe AI only makes the decision; the policy engine provides the safety. If you're building an LLM agent, stop trusting the prompt to handle security and start building a hard-coded validation layer.\n\n[Next Prompt Quality: The Token-to-Instruction Ratio →](/en/threads/3632/)", "url": "https://wpnews.pro/news/solana-ai-agent-my-deployment-workflow", "canonical_source": "https://promptcube3.com/en/threads/3777/", "published_at": "2026-07-26 17:25:13+00:00", "updated_at": "2026-07-26 17:39:50.366691+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "large-language-models"], "entities": ["Solana", "Devnet", "Model Context Protocol", "MCP"], "alternates": {"html": "https://wpnews.pro/news/solana-ai-agent-my-deployment-workflow", "markdown": "https://wpnews.pro/news/solana-ai-agent-my-deployment-workflow.md", "text": "https://wpnews.pro/news/solana-ai-agent-my-deployment-workflow.txt", "jsonld": "https://wpnews.pro/news/solana-ai-agent-my-deployment-workflow.jsonld"}}