# Architecture & Privacy
Most Web3 AI bots operate as black boxes, exposing user keys to centralized backends and leaking sensitive prompts and wallet associations to third-party LLM providers. AGNT is built on a strict zero-trust architecture, separating local key management from cloud-based AI execution.
#### The Client Layer (Key Management & Execution)
Security dictates that private keys must never touch external servers. The AGNT extension acts as a local encrypted enclave within the browser.
– EOA Architecture: AGNT relies on Externally Owned Accounts (EOAs) rather than ERC-4337 smart wallets. This eliminates smart contract risk and upgradeable proxy vulnerabilities at the wallet level.
– Client-Side Signing: All onchain actions are strictly signed client-side. The frontend utilizes the viem library (privateKeyToAccount and createWalletClient) to manage local state.
– Direct RPC Broadcasting: Once a transaction is signed locally, it is broadcast directly to public RPC endpoints. The backend infrastructure is completely bypassed during the signing and broadcasting lifecycle, ensuring zero backend key exposure.
Pre-Execution Simulation: Before a user is prompted to sign, the integrated simulation engine routes the transaction bytecode through a dedicated RPC node to compute exact state changes. It calculates token balance shifts and flags malicious modifiers (e.g., hidden taxes, honeypots) in real-time.
#### The Cloud Layer (Isolated Automation Environments)
When users deploy automated agents, the computation shifts to the cloud, but the isolation principles remain.
– Single-Tenant Containers: Users do not share database tables or server processes. Deploying an automation environment spins up a dedicated, single-tenant Dockerized instance.
– Delegated Agent EOA: To maintain the rule that your master key never touches the backend, cloud agents operate using dynamically generated, isolated EOA wallets. Users fund these specific agent addresses with isolated working capital. If the container is ever shut down, the agent wallet is cryptographically siloed from your main portfolio.
– Ephemeral Memory: Agent execution states are stored in isolated databases accessible only by that specific container.
#### The Intelligence Layer (BYO-LLM Engine)
The core privacy challenge is utilizing advanced AI models without feeding user custom workflows and onchain strategies to centralized data harvesting operations.
The system employs a Bring-Your-Own-LLM (BYO-LLM) architecture to sanitize inputs:
– Local Open-Source Execution: Users can run quantized open-source models (e.g., Llama 3) entirely within their isolated cloud container. In this mode, prompts and wallet data never leave the server instance.
– API Sanitization Pipeline: When utilizing external commercial models via custom API keys, the infrastructure acts as a privacy firewall. Before transmitting a prompt, the system strips exact wallet addresses, specific capital amounts, and identifiable data, replacing them with dynamic variables. The external LLM processes the logic, and the local container re-injects the sensitive data before constructing the transaction payload.
#### Data Handling & Telemetry
True privacy extends to usage tracking and metadata.
– Zero Third-Party Trackers: AGNT does not implement third-party analytics tools (such as Google Analytics or Mixpanel) on either the frontend or backend. All usage metrics are derived strictly from internal, first-party data sources.
– Sanitized Logging: The backend logging system tracks basic request metadata (method, URL, status code, response time) via a custom log.middleware. However, request headers and bodies containing sensitive tokens (such as JWTs) are explicitly stripped and never stored.
– Operational Data: For blockchain events, such as swaps, mints, or webhook-based updates, only the relevant transaction hashes and historical data required for operational continuity are stored in the database.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.agnthub.ai/agnt.hub/architecture-and-privacy.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.