CHU CHU 53

The more I think about AI trading agents, the more I keep landing on the same uncomfortable question: who actually gets to say no. Not in a legal sense, not in a "terms of service" sense, but in the literal, transactional sense the moment before a trade fires, before a swap executes, before an agent moves your capital somewhere you didn't quite anticipate. For years crypto has treated that moment as almost sacred. Code is law. The transaction either happens or it doesn't, and no intermediary gets to intervene. It's a beautiful idea. It's also, I've come to believe, an incomplete one.
Newton Protocol is built around that incompleteness. Its pitch isn't that agents need more intelligence or more speed the market has plenty of that already. Its pitch is that agents need permission, in a formal, verifiable, revocable sense, before they act. That's a much less glamorous problem than building a smarter trading bot, and I think that's exactly why almost nobody solved it first.
The mechanism is fairly elegant once you sit with it. Instead of hardcoding rules into a smart contract, or trusting a centralized risk desk to eyeball a transaction, Newton lets developers write policies in a language called Rego and routes transaction requests through a decentralized network of operators who evaluate those policies before execution. Those operators stake collateral through EigenLayer restaking, so if they approve something they shouldn't, there's real money on the line. Every evaluation produces a cryptographic attestation a receipt proving the check actually happened the way it claims to have happened. In theory, that turns compliance from a phone call to a compliance officer into something closer to a math proof.
That's the part I can't really ignore: this is one of the few crypto ideas I've encountered that treats "trust but verify" as a literal engineering spec rather than a marketing slogan. Sanctions screening, jurisdictional rules, spending limits, volatility triggers all of it becomes policy that lives outside the smart contract, checkable, auditable, updatable without redeploying anything. For AI agents specifically, where the whole anxiety is "what happens when the thing acting on my behalf goes rogue or gets exploited," having a pre-transaction authorization layer that can simply refuse to let a policy-violating trade settle is not a small thing. It's the difference between hoping your agent behaves and having a system that structurally prevents it from doing otherwise.
But here's the harder question. An authorization layer, by definition, is a layer that can say no. And the moment you build infrastructure whose entire purpose is refusing transactions, you've built something that inherits every unresolved argument about who writes the rules. Newton's operators are decentralized, restaked, economically accountable but the policies themselves still come from somewhere. A stablecoin issuer, an institution, a regulator-adjacent oracle provider. Chainalysis-style risk data, OFAC lists, KYC thresholds these aren't neutral physics, they're judgment calls encoded as if they were physics. Compliance-as-code doesn't eliminate the politics of compliance. It just makes the politics harder to see, because now it's buried in a policy file instead of a committee meeting.
That's the friction I keep coming back to. Newton frames itself as replacing centralized gatekeepers, and mechanically, it does no single custodian is unilaterally freezing your funds. But functionally, if enough institutional policy providers converge on similar risk parameters, you end up with something that behaves an awful lot like a gatekeeper, just one with better cryptographic bookkeeping. Decentralized enforcement of centralized judgment is still centralized judgment. It's just harder to protest, because there's no CEO to email there's a Rego file and a network of operators who were only ever asked to check whether you matched the rule, not whether the rule was fair.
There's also the quieter trust assumption sitting underneath the trusted execution environments Newton leans on for its off-chain computation. TEEs are a pragmatic choice they let sensitive policy logic run privately while still producing verifiable proofs but they are, at bottom, a bet on chip manufacturers and their firmware, not a bet on math alone. Zero-knowledge proofs get you verifiability of outcomes; they don't fully erase the fact that somewhere in the stack, you're trusting a piece of silicon to behave. That's not the same thing as trustlessness in the purest cypherpunk sense, and I think projects in this category owe it to their users to say that plainly instead of letting "ZK" and "TEE" blur together into a single reassuring buzzword.
Then there's the token itself. NEWT sits at the center of all of this paying for policy evaluation, collateralizing operators, governing upgrades to the very rules that decide whether your agent's trade goes through. That's a genuinely interesting design, because it means the people securing the authorization layer have skin in the outcome of the authorizations. But it also means the protocol's neutrality is, in part, a function of token distribution and staking incentives holding up under pressure and those are economic conditions, not moral guarantees. Vesting schedules unlock over time. Incentives can concentrate. A system that's credibly neutral today because restaked capital is well distributed can look very different in three years if that capital consolidates around a handful of large operators who all happen to see risk the same way.
I don't say any of this to dismiss what Newton is attempting. If AI agents are going to manage real capital and they clearly are, whether or not the infrastructure is ready then a world where every agent has an unaccountable, hardcoded, un-auditable rulebook is worse than a world where the rules are explicit, checkable, and enforced by an economically bonded network. Newton's bet is that visible, programmable friction beats invisible, arbitrary friction. I mostly agree with that bet. I just don't think it resolves the underlying tension so much as it relocates it from human gatekeepers to policy authors, from opaque risk desks to transparent but still human-authored Rego files.
What stays with me is this: every generation of financial infrastructure eventually builds its version of an authorization layer, because unrestricted execution turns out to be something almost nobody actually wants once real money is moving through it. Visa built one. SWIFT built one. Now crypto is quietly admitting it needs one too, dressed up in zero-knowledge proofs and restaked collateral instead of compliance departments. The question Newton Protocol raises isn't whether AI trading needs permission it clearly does. The question is whether we're finally ready to be honest that permission was never really about trustlessness. It was always about deciding, carefully and out loud, whose judgment we're willing to encode into the machine.
@NewtonProtocol $NEWT #Newt

私が初めて、「起きた後に後始末をしてごちゃごちゃをほどく」のではなく、「実際にその取引が起きる前に拒否できる」ブロックチェーンを思い描いたとき、全体の仕組みそのものが、頭の中で並べ替わっていくような感覚がありました。クリプトは、実行において常に並外れている一方で、判断には無関心です。コードは命じられたとおりに、即座に、そして不可逆に実行されます。そして、この業界のほとんどの歴史において、それが“賢明な内容かどうか”は、あまり気にされてきませんでした。ニュートン・プロトコルの根本的な前提は、この状態が永遠に続く必要はないということです。判断そのものを記述し、自動的に検証し、取引が“起ころうとする瞬間”に正確に執行できるようにすればよい。そうすれば、後から弁護士や監査人が、すでに起きてしまった何が悪かったのかをつまみ上げて再構築するのではなくて済みます。

Newton Protocol のビジョンについて考えれば考えるほど、それは新しい文法で昔からある不安に答えようとする試みのように感じます。この不安は、何か自動化されたものにお金を渡したことがある人なら誰でも理解できます。たとえば、取引ボット、いわゆる「スマート」なイールド・ボールト、そしてバックテストの結果が良かったから信頼していいと告げられたアルゴリズムです。あなたは許可を与えて、その挙動を待ちます。うまく振る舞ってくれることを願いながら。Newton の答えは、その「希望」を「証明」に置き換えることです。AI エージェントがとるあらゆるアクションは、保護されたハードウェアのセキュア・エンクレーブの中で実行され、ゼロ知識証明で包まれて実行されます。だからこそ、運用者の言葉を信じるのではなく、自分で検証できる数学を信じることになるのです。私は、この言い換えが本当に見事だと思いますし、ブランディングだけの話ではないとも感じています。これは、分散型金融における現実の、未解決の課題に向けたものです。

私が初めて、「実際のお金」を完全に保管する取引ボットで、しかもそれが完全に自律的に動く状況を思い描いたとき、私を不安にさせたのは知能ではありませんでした。不安にさせたのは沈黙です。現実の時間の中で、誰もスクリプトに許可を求めません。スクリプトはただ実行するだけです。人が何かがおかしいと気づく頃には、取引はすでに成立していて、カウンターパーティーには支払いが済んでいます。残るのは、事後に何が起きたのかを再構成することだけです。
それはいつだって、アルゴリズム取引の静かなリスクとして潜んできました。誰かがそれを「AIエージェント」と呼ぶはるか前からです。人々は戦略リスク、過剰適合したバックテスト、そしてこれまで見たことのないレジームで破綻するモデルについて心配します。でも、より現実的な失敗はそれより単純です。ボットには幅広い権限がありながら、それをどの場面で使うべきかの理解が狭いのです。鍵（キー）が複数のシステムで使い回されます。誰も検証していないウォレットとエージェントがやり取りします。これらは、アルゴリズムが間違っていることを必要としません。必要なのは、それを囲む境界が曖昧であることだけです。