Square By Shahid

The Detail Buried in a GitHub Repo
Most of what I've written about Newton has come from its own docs and litepaper — reasonable places to start, but they're also, obviously, marketing surfaces. This time I went to Newton's actual GitHub organization instead, mostly out of curiosity about what code genuinely exists versus what's still just described.
One repo stopped me: `trustless-agents-erc-ri`. A reference implementation for ERC-8004.
That's worth unpacking, because it's a different kind of signal than anything else I've found so far.
Ehat ERC-8004 Actually Is
ERC-8004, titled "Trustless Agents," is a proposed Ethereum standard — currently a draft EIP, not a finalized one — authored by Marco De Rossi (MetaMask), Davide Crapis (Ethereum Foundation), Jordan Ellis (Google), and Erik Reppel (Coinbase), first proposed in August 2025. It extends Google's Agent-to-Agent (A2A) protocol with a trust layer, giving AI agents three onchain registries: an identity (minted as an ERC-721 token pointing to an "agent card" describing what the agent does), a reputation trail built from client-authorized feedback, and a validation layer that supports proving a task was actually completed correctly — via staking, TEEs, or zero-knowledge proofs.
Put simply: it's an attempt at a shared, cross-platform answer to "how does an AI agent prove who it is and what it's actually capable of, to a counterparty it's never interacted with before, without a central company vouching for it." By early 2026, reference implementations were reportedly live across several testnets, with backing and momentum from some genuinely major players in the space — MetaMask, Coinbase, the Ethereum Foundation itself.
Newton isn't the author of this standard. It's one of the projects building a reference implementation for it.
Why That Distinction Matters
This is a different posture than most of what I've covered about Newton so far. The policy engine, the operator consensus, the Keystore — those are Newton's own proprietary architecture. Building toward ERC-8004 is Newton plugging into infrastructure the broader Ethereum ecosystem is building collectively, with contributors from MetaMask and Coinbase, not something Newton controls or could unilaterally change.
That's a meaningfully different bet than building a fully closed system. If ERC-8004 becomes a real, widely-adopted standard for agent identity, a Newton-authorized agent could theoretically carry an identity and reputation that other platforms — not just Newton's own ecosystem — recognize and can query. That's the opposite of a walled garden. It's a bet that interoperability, not proprietary lock-in, is what actually wins for agent infrastructure long-term.
Where This Actually Fits With What Newton Already Does
There's a fairly natural fit here, worth spelling out rather than assuming. ERC-8004 answers "who is this agent, and what's its track record" — identity and reputation. Newton's own policy/authorization layer answers a different question: "regardless of who this agent is, what is it actually allowed to do right now, and can that be checked and enforced." One is about reputation over time. The other is about hard constraints in the moment. A reasonable case could be made that serious agentic infrastructure eventually needs both — knowing an agent's track record doesn't stop it from making a catastrophic decision today, and hard spending limits don't tell you whether an agent is generally trustworthy across many interactions.
I want to be careful here, though: I haven't found anything from Newton explicitly laying out how (or whether) these two systems are meant to work together in production today. The repo's existence tells me they're building toward compatibility with the standard. It doesn't tell me the two systems are already integrated, or exactly how that would work end to end.
The Honest Caveats
A few things worth being direct about:
**ERC-8004 itself is still a draft.** It hasn't gone through the full Ethereum Improvement Proposal finalization process. Standards at this stage can change significantly, stall out, or fail to gain enough adoption to matter, regardless of how many credible names are attached early on.
**A reference implementation isn't the same as production usage.** Newton having a repo implementing this standard tells me they're technically engaging with it. It doesn't tell me any live Newton product actually depends on it today, or how mature that implementation is compared to others building toward the same standard.
**This is one signal, not a verdict.** I think it's a genuinely interesting data point about how Newton is positioning itself — as an ecosystem participant rather than a closed system — but one GitHub repo doesn't prove a company-wide philosophy, and words on a roadmap can outpace what actually ships.
Why I Went Looking for This
Most analysis of Newton — mine included, up to this point — has worked from the same handful of official documents. I wanted to check whether the code told a consistent story, or a different one. What I found was a project that's at least attempting to build toward shared, external standards rather than only its own proprietary stack. That's a more specific and more checkable claim than "Newton values interoperability" as a marketing line, because you can actually go look at the repo yourself.
@NewtonProtocol $NEWT #Newt
*This is not financial advice. ERC-8004 is a draft standard, not finalized — verify its current status before treating any of this as settled infrastructure.*😊

I wanted to actually understand how a Newton policy check runs, mechanically, instead of just repeating "it's verifiable" like that explains anything. Turns out there are two different pieces doing two different jobs, and mixing them up is easy.
**Piece one: where the policy actually runs**
When a transaction comes in, operators evaluate the relevant policy inside a Trusted Execution Environment — a TEE. If you haven't run into the term, think of it as a locked box built into the hardware itself: even the operator running the machine can't peek inside while the code executes or tamper with the result without it being detectable. That's different from just "trust the operator's server." The hardware itself is part of the guarantee.
The policy logic is written in Rego — a declarative language, same one the Open Policy Agent project uses. Inside the TEE, the operator runs the transaction data against that policy and produces two things: an approve/deny result, and a cryptographic proof that the evaluation actually ran correctly, untampered.
**Piece two: proving it without exposing everything**
This is where zero-knowledge proofs come in, and they're solving a different problem than the TEE. A TEE gets you "this ran correctly, on real hardware." A zk proof gets you "this rule was satisfied" without necessarily revealing the private data that satisfied it — an identity check, a financial detail, whatever the policy needed to look at.
Put together: TEE handles integrity of execution, zk proofs handle privacy of the underlying data. Neither one alone gets you both.
**Why this matters more than it sounds**
Compliance systems in traditional finance mostly work by trusting an institution's word — "we checked, it's fine." Newton's pitch is that you don't have to take that on faith. The output is a receipt anyone can verify on Newton's own explorer, without needing the underlying sensitive data ever exposed to get that verification.
That's a genuinely different trust model than "here's our audit report, trust us." It's closer to "here's cryptographic proof the check happened and passed, go verify it yourself if you want."
**Where I'd push back a little**
TEEs aren't a magic bullet. They've had real vulnerabilities discovered in the past across the industry — side-channel attacks, hardware bugs — and "trust the chip manufacturer's security guarantees" is still a form of trust, just a different one than "trust the company running the server." I haven't seen Newton's own materials go deep on which specific TEE vendor/hardware they're relying on or how they handle a scenario where a TEE vulnerability gets discovered later. That's a fair question to ask them directly rather than assume it's a solved problem forever.
And zk proof generation isn't free — there's real computational cost and latency to generating these proofs, which matters if the system needs to handle a lot of transactions quickly. How that scales under real load is something to watch, not something I'd assume works perfectly just because the whitepaper says so.
**The honest takeaway**
This is a legitimately more rigorous approach than "trust our backend," combining hardware isolation with cryptographic privacy in a way that's fairly deliberate. It's also not magic — it inherits real, known limitations from both TEEs and zk systems, and Newton being mainnet beta means none of this has been stress-tested over years yet.
@NewtonProtocol $NEWT #Newt

Most of what gets discussed about Newton is vaults and AI agents — makes sense, that's where mainnet beta actually launched. But buried further down their own use-case docs is something with a way bigger addressable market and way higher stakes: stablecoins and real-world assets.
Global stablecoin supply is sitting around $310 billion as of early 2026, Tether and Circle dominating. RWA tokenization — bonds, treasuries, credit — is smaller but growing fast on top of that. Both share the same tension: they're financial instruments that increasingly have to satisfy real regulatory obligations, running on infrastructure that was never built with those obligations in mind.
**What "compliance" actually means here**
For a stablecoin issuer, Newton's use case is pretty specific — not "compliance" as a vague buzzword. Per their own docs: block mints or redemptions tied to elevated-risk entities, enforce transfer-level compliance, checking a transaction against sanctions lists before it settles, not after someone notices a shady transfer later. They frame it almost like programmable, VISA-style payment rails — but onchain and checkable, instead of living in a private company's backend.
That separation matters. Right now, if an issuer wants to block a sanctioned address from redeeming, that logic's usually stuck in a centralized backend or hardcoded rigidly into the token contract. Newton splits policy from contract — update a sanctions list without redeploying the token, and every enforcement decision produces a receipt anyone can independently check, not just a private log only the issuer sees.
**Why this might actually matter more than vaults**
Vaults are a reasonable place to prove the concept — contained, sophisticated users, moderate stakes. Stablecoins and RWAs are a different order of magnitude. A meaningful chunk of that $310B is issued by entities that already answer to regulators in some form — GENIUS Act in the US, MiCA in the EU, both still evolving.
If a protocol can credibly say "here's proof to a regulator that your compliance controls were actually enforced, transaction by transaction, without exposing customer data" — that's a genuinely different pitch than "better yield vault." That's the kind of thing that could actually unlock institutional capital that's sitting out of DeFi specifically because the compliance story isn't checkable enough for legal teams to sign off on.
**What's live vs. what's still a pitch**
Being straight about this — the policy framework and the mint/redemption logic exist and are documented for developers. What's genuinely unclear is how many actual stablecoin or RWA issuers have integrated this in production, at what volume, for how long. Mainnet beta's headline launch and initial focus was vaults, via VaultKit with Euler. Stablecoin/RWA looks like a supported, actively marketed use case — not the flagship one with a comparable public track record yet
**The actual test**
The question isn't whether the architecture could work for a stablecoin issuer — the mechanism (policy separated from contract, checkable receipts, privacy-preserving checks) is a coherent answer to a real gap. The question is whether an issuer moving billions is willing to route mint/redeem decisions through a relatively new decentralized network instead of keeping that logic in-house where they control everything. That's a trust and liability call as much as a technical one. Institutions move slow on this stuff, usually only after watching someone else run it successfully first.
My guess: vaults end up being less the main event and more the proving ground — where Newton has to demonstrate years of reliable operation before a stablecoin issuer with real regulatory exposure is willing to go first.
@NewtonProtocol $NEWT #Newt

I kept coming back to a scenario that never actually happened.
Not a hack. Not a bad model release. Just a hypothetical.
An AI agent is given a wallet. It's told to manage a small allocation across a few vaults. It reasons well, most of the time. It reads yields, checks conditions, rebalances.
Then someone asks: what happens the one time it reasons its way to a wrong conclusion, and the wallet it's holding has real capital in it?
I used to think the answer was about model quality. Better reasoning, fewer mistakes, problem solved eventually.
I don't think that anymore.
A mistaken research summary is easy to correct. Someone reads it, notices something's off, fixes it. The cost of being wrong is a wasted hour.
A mistaken transaction settles anyway. The chain doesn't pause to ask whether the reasoning behind it made sense. It checks whether the signature is valid, and moves the funds.
Those aren't the same category of mistake, even though they can come from the exact same underlying model having an off day. One changes an opinion. The other changes ownership.
Once an agent holds a private key and decides to sign, there's no second decision point left. The judgment call already happened, upstream, invisibly, and the blockchain has no way to ask it to reconsider.
That's the part that actually worried me. Not that AI would be wrong sometimes — every system is wrong sometimes — but that the wrongness and the authority to act on it were bundled into the same moment, held by the same actor, with nothing in between.
**Where Newton fits into that gap**
I went looking at how Newton Protocol handles this, mostly because "agent authorization" is one of the use cases it's built around, and I wanted to know if it addressed the specific failure mode above or just talked around it.
The answer is narrower and more mechanical than I expected, which I think is a point in its favor.
Agents aren't designed to hold a raw private key with unrestricted signing power. Permissions run through something Newton calls the Keystore — a place where session keys and zkPermissions are defined ahead of time, by whoever is accountable for the capital, not decided in the moment by the agent itself. An agent operates inside a boundary that was set before it ever reasoned about anything.
On top of that, every transaction still gets evaluated against policy before it settles — spending caps, approved counterparties, mandate limits — by an independent network of operators, not the agent's own judgment. The policies are written in Rego, the same declarative language used by the Open Policy Agent project, and operators back their evaluations with restaked ETH through EigenLayer, so a wrong call has a cost attached to it, not just a shrug. The result is a signed authorization receipt, verifiable after the fact, showing whether a transaction was permitted and against what rule.
None of that makes the agent's reasoning better. I want to be clear about that, because it would be easy to oversell this as "solving AI reliability," and it isn't that.
What it changes is the size of the blast radius when reasoning goes wrong. A flawed conclusion inside a scoped, policy-checked boundary can be caught before it settles. A flawed conclusion inside an unscoped wallet with a live private key just becomes a transaction.
**What this doesn't answer**
I don't think this fully closes the original question. It relocates it.
The question stops being "can I trust this agent's judgment" and becomes "who defined the boundary the agent operates inside, and how well does that boundary match the risk actually being taken."
A boundary that's too loose recreates the original problem in a smaller container. A boundary that's too tight makes the agent useless — no automation is worth deploying if every meaningful action requires a human to widen the permission first, at which point you haven't really delegated anything.
Getting that calibration right isn't a cryptography problem. Newton can make the boundary enforceable and verifiable; it can't tell a curator or a developer where the boundary should actually sit. That's still a judgment call made by a person, upstream of all of this — just a narrower, more specific judgment call than "trust the whole system."
**Why I think this is still worth paying attention to**
I'm not fully convinced the smaller question is actually smaller. But I think it's a better question than the one it replaces, because it's answerable in a way "trust the AI" never really was. You can inspect a policy. You can audit an authorization receipt. You can't audit a private key that's already signed something.
Newton is in mainnet beta. The agent-authorization use case is part of the current feature set and roadmap, not something with years of production history behind it yet. That matters, and I'm not pretending otherwise.
But the framing — reasoning quality and settlement authority are different problems, and bundling them together is where the real risk lives — is the part I keep coming back to, independent of how any one protocol executes on it.
@NewtonProtocol l $NEWT #Newt

I've been thinking about Newton's approach to operators, and it changed the way I look at decentralization.
For a long time, I assumed a decentralized network had to be completely permissionless. If anyone could join, that meant it was more decentralized. Simple.
Newton challenges that assumption.
Instead of opening the door to everyone, it relies on operators that are credibly vetted. They have to meet standards around reliability, responsiveness, geographic diversity, legal status, and operational readiness before they can participate.
My first reaction was that this sounded like a compromise.
The more I thought about it, though, the more it felt like a trade-off rather than a step backward.
Open participation is valuable, but it doesn't guarantee dependable infrastructure. A network can have thousands of participants and still struggle if too many of them aren't able to perform consistently when it matters.
Newton's focus seems to be different. Rather than maximizing the number of operators, it's trying to build a network of independent operators that can actually be trusted to keep the system running.
For the kind of applications Newton is targeting, that approach makes sense. Reliability and accountability aren't optional—they're part of the product.
It also raises an interesting question.
Should decentralization be measured by how many people can participate, or by how resilient the network remains because of the people who do participate?
I'm still thinking about the answer, but I find Newton's perspective worth paying attention to.
@NewtonProtocol $NEWT #NEWT

Newton Mainnet Beta: The Authorization Layer for DeFi Automation
I was going through Newton's mainnet beta documentation and something stopped me.
Most blockchain automation works like this: you write a smart contract, deploy it, and hope it does what you expect. If something goes wrong, you're left with a transaction hash and a lot of questions.
Newton does it differently. Every automated action gets cryptographically verified. When an agent executes a trade or moves funds on your behalf, it produces a proof that the action stayed within your predefined boundaries. Not just a log entry. A cryptographic receipt.
That changes the trust model entirely.
Instead of trusting the agent or the developer, you trust the math. The protocol combines TEEs (Trusted Execution Environments) with ZKPs (Zero-Knowledge Proofs) to verify that every operation was performed exactly as authorized. No shortcuts. No blind spots.
Newton is building what they call a "verifiable automation layer" — a policy engine that sits between your wallet and the agent, checking every transaction before it settles. Spend limits, counterparty checks, collateral requirements — all enforced programmatically with auditable proofs.
The mainnet beta launched on June 23 with VaultKit SDK, a toolkit that lets developers define programmable transaction rules. RedStone and Credora are already integrated as launch data partners.
What caught my attention wasn't just the technology. It was the gap Newton is trying to close.
Right now, DeFi automation relies on trust. You trust the bot operator. You trust the developer. You trust the infrastructure. Newton is trying to replace trust with verification — making automation safer for institutions and individuals alike.
$NEWT powers this ecosystem — used for staking, gas fees, agent collateral, and governance. ~264M tokens currently circulating.
For me, the real question is: as DeFi becomes more automated, how much trust are you willing to delegate?
@NewtonProtocol ol $NEWT #Newt

I found myself thinking about something Newton's mainnet beta revealed.
We talk about AI agents and automation in crypto constantly — but nobody really asks: how do you know the agent stayed within its bounds? How do you prove it didn't do something it wasn't supposed to?
That's where Newton comes in.
The protocol is built around three core principles: Scoped Autonomy, Verifiable Integrity, and Earned Reputation.
Scoped Autonomy means you define exactly what the agent can and cannot do — using zkPermissions to encode expressive rules that go far beyond simple spend limits. Think counterparty checks, jurisdiction restrictions, collateral requirements, and time-bound permissions.
Verifiable Integrity means every action produces a cryptographic proof that it aligned with those rules. Using a combination of TEEs (Trusted Execution Environments) and ZKPs (Zero-Knowledge Proofs), Newton ensures that every operation is performed exactly as authorized.
Earned Reputation means agents build trust through proven performance. Good behavior earns reputation. Bad behavior triggers economic penalties. The system doesn't rely on blind faith — it relies on incentives and verifiable history.
The mainnet beta launched on June 23 with VaultKit SDK — a toolkit that lets developers build programmable transaction policies. RedStone provides verified price data for policy enforcement. Credora handles credit risk assessment. Together, they form a compliance and risk management layer that institutions can actually rely on.
What I keep circling back to is Newton's positioning as an "authorization layer" for onchain finance. It's not trying to be another L2 or another DeFi protocol. It's trying to be the policy engine that sits between you and your automated agents — making sure nothing happens without your permission, even when you're not watching.
The $NEWT token powers this ecosystem:
· Staking for network security
· Paying gas fees for automation
· Collateralizing agent services
· Governance participation
1 billion total supply, ~264M currently circulating.
It feels like one of those infrastructure projects that could quietly become essential — the kind you don't notice until it's missing.
For me, the real question is: as DeFi becomes more automated, how much trust are you willing to delegate? And how would you even verify that trust after the fact?
Newton is building an answer to that question.
What matters most for safe DeFi automation?
· Cryptographic verification of every action
· Clear user-defined boundaries
· Economic penalties for bad behavior
· All of
the above
@NewtonProtocol $NEWT #Newt