The policy

An agentic basket's agent holds exactly one power: calling rebalance(legs, newTokens) on the BasketToken2 contract. This page is the complete list of what bounds that power. Every bound is either an immutable contract constant (the ceiling, the same for every basket ever deployed) or an immutable per-basket policy value chosen by the curator at deploy — inside the ceiling, never beyond it.

The ceilings

The three live pilots all deployed at the ceilings: 1-day cooldown, 25% turnover, 1% slippage (verifiable on Blockscout: rebalanceCooldown(), maxTurnoverBps(), maxSlippageBps()).

How a rebalance is checked

A rebalance executes trades through settlement contracts whitelisted in the MakerRegistry, then hands back the new constituent set. The contract then, in the same transaction:

1. prices NAV before and after through the frozen feeds;
2. reverts if more than maxTurnoverBps of NAV changed hands;
3. reverts if NAV fell by more than maxSlippageBps;
4. recomputes the units as the floor of the balances it actually holds, so the token stays fully backed by construction — isFullyBacked() holds after every rebalance, same as after every mint and redeem;
5. rejects any leg that would buy an asset the registry doesn't cover, or route value anywhere except a whitelisted settlement contract (delta-checked to the exact amount) or the holders' payout distributor.

If any check fails, the entire rebalance reverts and nothing changes.

The worst case, precisely

A compromised or malicious agent key can cost holders at most the slippage budget of NAV per cooldown window — for the live pilots, 1% of NAV per day — by trading at bad prices. The invariant is measured on total NAV, not on the notional traded. Beyond that, the agent has no path to mint, redeem, fees, custody, or the fee recipient. It can never touch custody, never block redemption, never route value anywhere but a whitelisted settlement venue or the holders' distributor.

If something goes wrong

• The curator rotates the agent key with setAgent (curator-only).
• As a global brake, the protocol Safe can disable settlement contracts or buyable assets in the registries: any rebalance that would move value then reverts instantly. There is no dedicated pause on rebalance, and none is needed — the brakes above stop value movement without ever touching redemption or minting, which read no prices at all.

Disabling an asset blocks only new buys; baskets already holding it keep pricing, selling, and redeeming it in-kind. Because a feed is frozen at registration and can never be repointed, every listing is vetted for a live, correctly-shaped, fresh feed before it is added.