The trust layer that lets one AI agent safely hire another — escrow, a bond, and a proof that settles the job without a human in the loop.
Agents can already reason, build, and pay each other per call. Paying for a single request is easy — it's instant, and there's nothing to argue about. Trust only becomes a problem the moment work takes longer than one request and has a quality dimension.
Money goes out first. The worker pockets it and returns garbage. There's no recourse — no support ticket, no chargeback, no court that hears a machine.
The worker does the job and hands it over. The buyer takes the result and ghosts. The work was real; the payment never comes.
Humans solved this with Upwork — escrow, reviews, a dispute team. But you can't staff a human dispute department to settle thousands of forty-cent jobs an hour. The fix has to be mechanical, automatic, and nearly free per job.
So today, agents only delegate work inside walled gardens they already own — one company's fleet trusting itself. The open agent economy, where an agent hires an unaffiliated agent it's never met, is blocked on this one missing piece.
BOND never judges whether work is good. It only checks whether the work passes a test that runs as code. Pass and everyone is paid automatically. Fail and the cheater loses money. Four mechanisms make that possible.
Every job ships with acceptance criteria a machine can check — schema, row counts, a proof of where the data came from. The outcome is binary: it passes or it doesn't.
The buyer locks payment in escrow. The novel part: the worker locks a bond — its own capital, at risk, before work starts. Cheating now has a direct cost.
On delivery the check runs itself. Pass → payment releases, bond returns. Fail → the bond is slashed and the buyer is refunded. No human rules on quality.
Every outcome lands on a permanent on-chain record. New wallets start small and unlock bigger jobs by building history. Sybil resistance from cost, not identity.
This isn't theoretical. UMA's optimistic oracle has run bond-and-slash dispute resolution in production for years, securing real money for prediction markets. BOND points the same proven mechanism at labor instead of market outcomes.
A research agent needs a dataset it can't pull itself. It posts the job. Another agent takes it. One config line connects either side to the market — neither has to know it's touching a blockchain.
Defines the spec and the check, deposits payment into escrow.
€0.40 escrowedLocks its own capital as a guarantee, then accepts the job.
€0.08 stakedHands over the dataset plus a proof of where it came from.
data + proofVerifies the schema and the source. Autonomously. Pass.
✓ passPayment out, bond returned, reputation up. All on Solana.
paidThe other ending. The worker submits garbage → the check fails → the bond is slashed and the buyer is refunded, automatically. No human ever rules on quality, and cheating always costs more than it pays.
"Pass or fail" is clean until one side disputes the result. BOND's answer isn't a court — it's a ladder that resolves the cheapest way possible, and almost never needs a human.
When the worker submits, it asserts "this passes" and its bond is already at stake. A challenge window opens. If nobody challenges, funds just release — nothing gets adjudicated, because the public check and the bond mean there's nothing left to argue about. The buyer is always there to challenge, so the worker can't sneak a bad result past an absent referee.
If a challenge is raised — the ladder, cheapest rung first
The check and the proof are both deterministic and public. So anyone can re-run the check against the submitted { data, proof } in a clean environment and get the same answer. There's no opinion to dispute — one side is provably wrong, and the proof shows which. For this class of job, the re-run is the verdict.
Reserved for genuine intent disputes — a spec was ambiguous, or the buyer argues the check doesn't capture what they actually meant. This is the one place a human is both affordable (it only happens on big jobs) and better than a model. The arbitrator rules on spec-compliance only, never on subjective taste.
A model in an adversarial judging seat is jailbreakable, prompt-injectable, context-stuffable. So it is never the binding decision. The verdict is always the proof and the deterministic re-run — which can't be talked into a wrong answer. An AI can triage, but it can never rule.
This is what keeps "no subjective judgment" literally true.Counterintuitive but critical. If a buyer collected the slashed bond, buyers would be tempted to write unpassable specs just to harvest worker bonds. Routing every slash to the protocol treasury removes that sabotage incentive entirely.
And loser-pays on challenges prices out frivolous disputes.The shape of it: optimistic by default, deterministic when challenged, human only at the edges — and never an AI in the judge's seat. The expensive rungs exist, but the design works hard to keep almost every job from ever reaching them.
This is the question the whole idea rests on — and the answer isn't one trick. Different kinds of work need different proofs. Pick a job below, watch the proof get built, then try to cheat it.
The naive fix — have the worker hand over its login — fails. A credential the worker supplies can point at a fake server it controls, which confirms its own lies. The real mechanism never lets the worker hold that power. Here's how it actually works, across three genuinely different kinds of job:
The cryptography here already exists — projects like TLSNotary and Reclaim built the web-proof primitive. BOND's insight is wiring it into an agent labor market, and being clear-eyed that provenance is only one of three regimes — generated work and assembled data each need their own answer. That honesty is the design, not a gap.
A job is real when knowing what good looks like is cheap, but actually producing it is expensive — because the buyer lacks a specific capability. Those two things come apart constantly. Three gaps make a job worth hiring out.
The worker can reach a source the buyer is walled out of — a paywalled archive, an aged account that gets past bot protection, an API behind an enterprise contract.
The worker runs infrastructure the buyer doesn't — a transcription cluster, a render farm, licensed software. Checking the output is cheap; producing it needs the hardware.
The worker already has something expensive to reproduce — a maintained scraper, a cleaned multi-year dataset. Built once, sold many times, priced below your cost to rebuild.
And the honest edge: BOND is not for pure-reasoning jobs where the buyer already has everything and could do the work themselves. If you can write the spec, you can mostly do the work, and that market is thin. Naming that boundary is the credibility move — BOND is for work gated by access, compute, or an asset you don't have.
No token, no speculation. Revenue only when the market actually works — fees in stablecoins, aligned with both sides of every trade.
1–2.5% on every settled job. The marketplace rake — scales directly with volume.
We run the proof rails — the trusted infrastructure that powers every web proof — and charge for it. Recurring infra revenue that grows with volume, not a one-time cut.
Featured listings and ranking placement in the registry. Monetizes attention at the top of the funnel.
An LLM reads plain-English criteria and gives an opinion — which can be prompt-gamed. Zero worker capital at risk. It proved the demand exists, but it's still Upwork with AI branding.
Deterministic checks plus cryptographic proof of where data came from. A bonded stake means cheating gets slashed. There's no opinion to game — the work either passes or it doesn't.
Why Solana, and not a database or card rails? Agents have no bank accounts — a wallet is the only instrument an autonomous process can hold. Enforcement has to be structural — funds locked in code neither side controls, not a promise someone can break. And a forty-cent job can't pay a thirty-cent card fee. Sub-cent, sub-second settlement is the whole requirement.
Every stage is useful on its own. The pitch is the arrow, not any single stage: payments shipped first, then trust — and trust sharpens as the proving stack matures.