Agents that buy, sell and pay onchain — under a policy you wrote

Introduction

Large models can already decide what to buy. They cannot be trusted with a private key. Strix Hood exists to close that gap: it accepts a declarative intent from an agent, checks it against a signed spending policy, simulates it against live chain state, auctions execution to competing solvers, settles it, and writes an attestation that can be audited later.

The problem

Every practical approach to agent-driven commerce today fails in one of three ways.

All three collapse the same distinction: capability (the agent can produce a transaction) versus authority (the transaction is permitted). Strix Hood separates them. The agent produces intents. Authority lives in a policy that the agent cannot edit, committed onchain as a hash and enforced by the account's validator module at signing time.

The core promise

An agent holding a Strix Hood session key can spend only what the policy allows, only on the actions the policy names, only on the chains the policy lists, and only if the simulated asset diff matches what the intent claimed. Everything else reverts before it reaches the mempool.

Who it is for

• Agent developers shipping an autonomous trader, treasury manager, procurement bot or research agent that needs to move value without a human in the loop for every action.
• Applications that want to offer "let the assistant do it" without becoming a custodian or building a policy engine, simulator and router themselves.
• Solvers and market makers competing for agent order flow through the routing auction, and earning a share of the 0.25% fee.
• Risk and compliance owners who need a signed, replayable record of why every automated transaction was permitted.

What it is not

Strix Hood is not a wallet, not an LLM, and not a custodian. It never holds user funds outside of the atomic settlement window, it does not generate the agent's reasoning, and it does not decide whether a trade is a good idea. It decides whether a trade is permitted and executes it well. Read Security model for the explicit list of risks it does not remove.

Quickstart

This walkthrough gets a policy-governed agent from zero to a settled swap on Base Sepolia. It uses test keys throughout; nothing here touches mainnet value.

1. Install a client

The SDKs are thin, typed wrappers over the REST API. Every method in them maps to exactly one endpoint, so you can drop to raw HTTP at any point without losing behaviour.

npm install @strixhood/sdk
# or: pnpm add @strixhood/sdk / bun add @strixhood/sdk

pip install strixhood
# requires Python 3.10+

cargo add strix-hood --features rustls,stream

2. Create an API key

Keys are created in the console under Settings → API keys. Two prefixes exist and they are not interchangeable.

export STRIX_API_KEY="strx_sk_test_9f2c41bd7a084e6cb35d0e17"
export STRIX_ENV="testnet"

3. Write the policy first

Policies are created before agents, not after. An agent without a bound policy can be registered but cannot be issued a session key, so it can never sign anything.

{
  "name": "dca-conservative",
  "limits": {
    "per_tx_usd": 250,
    "daily_usd": 1000,
    "monthly_usd": 20000,
    "max_open_intents": 4
  },
  "allow": {
    "chains": ["eip155:8453", "eip155:42161"],
    "actions": ["swap", "transfer"],
    "tokens": ["USDC", "WETH", "cbBTC"],
    "venues": ["uniswap_v4", "aerodrome", "curve"]
  },
  "deny": {
    "categories": ["leverage", "gambling", "unverified_contract"]
  },
  "simulation": {
    "require_success": true,
    "max_price_impact_bps": 120,
    "min_liquidity_usd": 250000
  },
  "hitl": {
    "threshold_usd": 200,
    "channels": ["webhook"],
    "timeout_sec": 180,
    "on_timeout": "reject"
  },
  "expires_at": "2027-01-01T00:00:00Z"
}

curl -sS https://api.strixhood.xyz/v1/policies \
  -H "Authorization: Bearer $STRIX_API_KEY" \
  -H "Content-Type: application/json" \
  --data @policy.json | jq '{id, version, hash}'

{
  "id": "pol_01JQ8ZK3M2X7YB4N6PA0RTVCWD",
  "version": 1,
  "hash": "0x7d41a9c0b83e5f2d16c4a87b90ef3524ca1d6b8f0472e93a5c18df6027ab4e91"
}

4. Register the agent

Registration mints an Agent NFT Passport and locks a 2,500 $STRX bond. On testnets the bond is waived and the passport is minted on Base Sepolia.

import { Strix } from "@strixhood/sdk";

const strix = new Strix({ apiKey: process.env.STRIX_API_KEY! });

const agent = await strix.agents.create({
  name: "dca-eth",
  kind: "trader",
  policyId: "pol_01JQ8ZK3M2X7YB4N6PA0RTVCWD",
  chains: ["eip155:8453"],
  sessionKey: { ttlSeconds: 86_400, rotate: true },
});

console.log(agent.id, agent.smartAccount, agent.passport.tokenId);
// agt_01JQ8ZM7T4B0KC2N9XE5RVDHQP  0x1F3c…9aE2  #4182

import os
from strixhood import Strix

strix = Strix(api_key=os.environ["STRIX_API_KEY"])

agent = strix.agents.create(
    name="dca-eth",
    kind="trader",
    policy_id="pol_01JQ8ZK3M2X7YB4N6PA0RTVCWD",
    chains=["eip155:8453"],
    session_key={"ttl_seconds": 86400, "rotate": True},
)

print(agent.id, agent.smart_account, agent.passport.token_id)

use strix_hood::{Strix, CreateAgent, SessionKey};

let strix = Strix::from_env()?;

let agent = strix
    .agents()
    .create(CreateAgent {
        name: "dca-eth".into(),
        kind: "trader".into(),
        policy_id: "pol_01JQ8ZK3M2X7YB4N6PA0RTVCWD".into(),
        chains: vec!["eip155:8453".into()],
        session_key: Some(SessionKey { ttl_seconds: 86_400, rotate: true }),
    })
    .await?;

println!("{} {}", agent.id, agent.smart_account);

5. Submit the first intent

An intent is a statement of outcome, not a calldata blob. You never encode a router call, choose a pool or set a gas price — the solver auction does that, bounded by your constraints.

curl -sS https://api.strixhood.xyz/v1/intents \
  -H "Authorization: Bearer $STRIX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: dca-2026-08-16-0900" \
  -d '{
    "agent_id": "agt_01JQ8ZM7T4B0KC2N9XE5RVDHQP",
    "action": "swap",
    "chain": "eip155:8453",
    "params": {
      "sell_token": "USDC",
      "buy_token": "WETH",
      "sell_amount": "150.00"
    },
    "constraints": { "max_slippage_bps": 40, "route_preference": "best_price" }
  }'

{
  "id": "int_01JQ8ZP1V6C3MD8R0YF2WKGSTA",
  "object": "intent",
  "status": "policy_check",
  "agent_id": "agt_01JQ8ZM7T4B0KC2N9XE5RVDHQP",
  "policy_version": 1,
  "estimated": { "buy_amount": "0.04129", "fee_usd": 0.375, "price_impact_bps": 6 },
  "created_at": "2026-08-16T09:00:00.412Z"
}

6. Follow it to settlement

Poll GET /v1/intents/{id} if you must, but the stream is authoritative and costs no rate-limit budget. Both surfaces emit the same status values.

const stream = strix.stream.executions({ agentId: agent.id });

for await (const evt of stream) {
  console.log(evt.status, evt.txHash ?? "-");
  if (evt.status === "settled") {
    console.log("filled", evt.fills[0].buyAmount, "WETH");
    console.log("attestation", evt.attestation.uid);
    break;
  }
}

Core concepts

Seven objects carry the whole protocol. Everything else in this documentation is a detail of how they interact.

Intents

An intent is a signed, expiring statement of a desired outcome — "end up holding at least 0.041 WETH, spending at most 150 USDC, on Base, within 90 seconds". It contains no calldata, no route and no gas parameters. That deliberate omission is what makes intents safe to hand to a language model: the worst an adversarial prompt can produce is a request that the policy engine rejects.

Intents are immutable once accepted. Changing terms means cancelling and submitting a new one. Every intent carries an idempotency_key; replaying the same key inside 24 hours returns the original intent rather than creating a second one.

Agents

An agent is the protocol-side identity of an autonomous actor. It owns an ERC-4337 smart account, one bound policy, zero or more session keys, a reputation score, and a $STRX bond that can be slashed. An agent is not a wallet: the smart account is controlled by the owner's root key, and the agent only ever holds a scoped session key with an expiry.

The Agent NFT Passport

Registration mints an ERC-721 passport to the agent's owner. The passport is the portable record of what an agent is allowed to be, and it is the only object in the protocol that survives a full redeploy of the agent runtime.

• Identity — tokenId is the canonical agent reference onchain; agent_id is its offchain mirror.
• Dynamic metadata — level, lifetime settled notional, success rate and capability traits are re-rendered on every 1,000 settlements or on demand.
• Permission traits — the passport records which capability modules are equipped (execution, data, payment, intelligence, security). Equipping a module raises specific policy ceilings; it never lowers a policy floor.
• Revenue rights — for service agents, marketplace fees settle to the passport holder, so selling the NFT transfers the income stream.
• Slashing surface — the bond is escrowed against the tokenId. A slashed passport keeps its history; the history is the point.

The policy engine

A policy is a versioned document of limits, allow lists, deny lists, simulation thresholds and human-in-the-loop rules. It is evaluated offchain for speed and committed onchain as a bytes32 hash for enforcement. The two must agree: the session key validator recomputes nothing, but it refuses to validate a user operation whose attached policy hash is not the one the PolicyRegistry currently holds for that agent. Full schema in Policy engine.

Solvers and routing

Solvers are independent parties that compete to fill intents. When an intent clears policy and simulation, the router broadcasts a sealed request for quotes; solvers respond with a committed execution path and an output guarantee. The best quote by the intent's route_preference wins, and the winner is bound to its quote — under-delivering slashes 25% of the solver's bond and refunds the difference to the agent.

Settlement

Settlement is atomic per intent. The winning solver's path is executed through SettlementVault, which enforces the output guarantee in the same transaction: if the agent would receive less than the quoted minimum, the whole call reverts. Protocol fees are taken from the output leg at 0.25% and split on settlement. Cross-chain intents settle as two locally atomic legs with a bonded relayer, never as an optimistic promise.

Reputation and slashing

Every settled intent updates two scores. Agent reputation is a decayed ratio of settled to submitted intents weighted by notional, and gates marketplace visibility. Solver reliability is the ratio of honoured to won quotes, and gates auction participation. Both are recomputed onchain at each epoch (7,200 blocks on Ethereum, daily elsewhere). Slashing conditions and amounts are listed in Slashing.

Architecture

One intent travels through eight stages. Four of them can terminate it. The diagram below is the authoritative flow; the table under it names the component that owns each stage and what it is allowed to do.

Stage reference

Latencies are p50 measured over the last 30 days on Base and exclude block time. The end-to-end budget from received to a broadcast user operation is 440 ms; anything slower than 1,200 ms trips an internal alert and the intent is re-quoted rather than executed on a stale price.

Failure modes

Intent specification

The intent object is the single input surface of the protocol. It is stable across REST, WebSocket and all three SDKs; the SDKs only change the casing convention.

The intent object

constraints

Action types

Examples

Swap

A market swap with a hard 40 bps slippage bound and private routing. The sell_amount is exact; buy_amount is guaranteed at a minimum by the settlement contract.

{
  "agent_id": "agt_01JQ8ZM7T4B0KC2N9XE5RVDHQP",
  "action": "swap",
  "chain": "eip155:8453",
  "params": {
    "sell_token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "buy_token": "0x4200000000000000000000000000000000000006",
    "sell_amount": "1500.000000"
  },
  "constraints": {
    "max_slippage_bps": 40,
    "max_fee_usd": 6.00,
    "route_preference": "private",
    "mev_protection": true
  },
  "idempotency_key": "rebalance-2026-08-16T09:00Z",
  "metadata": { "strategy": "weekly-rebalance", "leg": "1/3" }
}

NFT trait bid

A standing bid across two marketplaces for any token in the collection matching both traits, live for seven days, denominated in WETH.

{
  "agent_id": "agt_01JQ8ZQ4E9F1NH7T2XM6BKWCVD",
  "action": "nft_bid",
  "chain": "eip155:1",
  "params": {
    "collection": "0xBd3531dA5CF5857e7CfAA92426877b022e612cf8",
    "traits": [
      { "type": "Background", "value": "Cosmic" },
      { "type": "Eyes", "value": "Laser" }
    ],
    "max_price": "3.85",
    "currency": "WETH",
    "marketplaces": ["opensea", "blur"]
  },
  "constraints": { "partial_fill": false, "route_preference": "fastest" },
  "expires_at": "2026-08-23T09:00:00Z"
}

Tokenized equity order

A limit order for tokenized Apple equity, good until cancelled, settled onchain against the issuer's transfer agent. Fractional quantities are permitted to six decimals.

{
  "agent_id": "agt_01JQ8ZR8H2K5PM3W9YT0CDNXBF",
  "action": "equity_order",
  "chain": "eip155:42161",
  "params": {
    "symbol": "AAPLX",
    "side": "buy",
    "notional": "2500.00",
    "order_type": "limit",
    "limit_price": "231.40",
    "time_in_force": "gtc",
    "venue": "backed_rwa"
  },
  "constraints": { "max_fee_usd": 8.00, "route_preference": "best_price" },
  "expires_at": "2026-09-16T20:00:00Z",
  "metadata": { "mandate": "core-equity", "reviewed_by": "risk-desk" }
}

Status values

Policy engine

A policy is the only thing standing between an agent and your balance. It is written by a human, versioned, hashed, committed onchain, and enforced twice — once offchain for a fast rejection, once onchain because offchain checks can be bypassed.

The policy object

Spending limits

All limits are denominated in USD and evaluated against the notional of the intent at the price observed during simulation, not at submission. Rolling windows are true sliding windows, computed over settled and in-flight intents so two concurrent requests cannot both slip under a cap.

Allow and deny lists

Evaluation is strict: an intent must match every relevant allow dimension and no deny entry. Omitting a dimension from allow denies it entirely. There is no wildcard for contracts.

{
  "allow": {
    "chains":      ["eip155:8453", "eip155:42161"],
    "actions":     ["swap", "transfer", "equity_order"],
    "tokens":      ["USDC", "WETH", "cbBTC", "AAPLX"],
    "collections": [],
    "contracts":   ["0x2626664c2603336E57B271c5C0b26F421741e481"],
    "venues":      ["uniswap_v4", "aerodrome", "backed_rwa"],
    "categories":  ["spot", "rwa_equity"]
  },
  "deny": {
    "tokens":     ["*_LEVERAGED", "*_3L", "*_3S"],
    "contracts":  ["0x0000000000000000000000000000000000000000"],
    "categories": ["gambling", "leverage", "unverified_contract", "sanctioned"]
  }
}

Human-in-the-loop

The human gate is a policy outcome, not a separate product. Above the threshold the intent moves to awaiting_approval, an approval.requested webhook fires with the full simulated asset diff, and the clock starts.

{
  "hitl": {
    "threshold_usd": 500,
    "actions": ["transfer", "nft_buy"],
    "always_for_new_counterparty": true,
    "channels": ["webhook", "push"],
    "timeout_sec": 300,
    "on_timeout": "reject",
    "approvers": ["usr_01JQ8ZS2M4N6P8R0T2V4X6Z8B0"],
    "quorum": 1
  }
}

• threshold_usd — escalate any intent whose notional exceeds this.
• actions — escalate these actions at any notional. Union with the threshold rule.
• always_for_new_counterparty — escalate the first interaction with any address the agent has never settled with before, regardless of size.
• on_timeout — reject fails safe (default); hold keeps the intent pending until an explicit decision, at the cost of a stale price.
• quorum — number of distinct approvers required. Approvals are signed by the approver's key and included in the attestation.

Policy hash and onchain commitment

The hash is what makes the policy enforceable rather than advisory. It is computed as follows, and the algorithm is fixed for the lifetime of an API version.

1. Drop every server-assigned field: id, version, hash, commitment, created_at, updated_at.
2. Canonicalise the remainder with RFC 8785 JSON Canonicalisation Scheme — keys sorted by UTF-16 code unit, no insignificant whitespace, numbers in shortest round-trip form.
3. Prefix the domain separator "strixhood.policy.v1" as UTF-8 bytes.
4. Take keccak256 of the concatenation. That 32-byte digest is policy.hash.
5. Call PolicyRegistry.commit(agentId, policyHash, version). The registry stores one live hash per agent and emits PolicyCommitted.

import { canonicalize } from "@strixhood/sdk/jcs";
import { keccak256, toBytes, concat } from "viem";

export function policyHash(policy: Record<string, unknown>): `0x${string}` {
  const { id, version, hash, commitment, created_at, updated_at, ...doc } = policy as never;
  const body = toBytes(canonicalize(doc));
  const domain = toBytes("strixhood.policy.v1");
  return keccak256(concat([domain, body]));
}

// Recompute locally and compare with what the registry holds.
const local = policyHash(await strix.policies.get("pol_01JQ8ZK3M2X7YB4N6PA0RTVCWD"));
const onchain = await registry.read.policyOf([agent.passport.tokenId]);
if (local !== onchain) throw new Error("policy drift: refuse to sign");

The session-key validator module reads the committed hash on every user operation and compares it with the hash embedded in the key's permission blob at issuance. Rotating a policy therefore invalidates every session key issued under the previous version — by construction, not by convention.

Evaluation order

Order matters because the first failure short-circuits and is reported as rejection.rule. Knowing the order tells you which rule to loosen.

Security model

This section is written to be argued with. It states what the protocol enforces, what it assumes, and what it cannot do. If a claim here is not testable against the contracts, it should not be here.

The five layers

Each layer is independent. Removing any one of them still leaves the others enforcing; none of them depends on another being honest.

Threat model

Assumed adversaries, and what the protocol does about each.

What this does not protect against

• Your root key. If the owner key controlling the smart account is compromised, the attacker rewrites the policy and every layer above is void.
• Bad strategy. A policy-compliant trade can still lose money. The protocol has no opinion on whether a permitted action is a good one.
• Market and liquidity risk. Slippage bounds guarantee an execution price, not a fair one. Thin markets stay thin.
• Third-party protocol failure. If you allowlist a lending market and it is exploited, funds you sent there are gone. Allowlisting is an explicit trust decision.
• Oracle and price-feed failure. Notional limits use observed prices. A manipulated venue price manipulates the limit calculation with it.
• RWA issuer and transfer-agent risk. Tokenized equities carry issuer credit risk, redemption risk and jurisdictional restrictions. The token is a claim, not the share.
• Deep reorgs and chain halts. Attestations follow the canonical chain; a reorg beyond the finality target can unwind a settled intent. See Failure modes.
• Phishing the human approver. The human gate is only as good as the person reading the diff. Approval fatigue is a real failure mode; set thresholds you will actually respect.
• Regulatory and tax exposure. Automation does not change your obligations, and the protocol does not file anything on your behalf.
• Availability. The protocol depends on the underlying chains, bundlers and relays. Degraded modes are published on the status page.

Audits and disclosure

No audit has been completed. No firm is engaged, no report exists, and every contract currently running on a testnet is unaudited. The table below is the scope we intend to put in front of an external firm, published now so the order is on the record before the engagement is.

There is no funded bug bounty. Report vulnerabilities to security@strixhood.xyz with the PGP key published at /.well-known/security.txt anyway — findings are credited and published, and the reward schedule is set out on the security page. Do not open a public issue. Disclosure target is 90 days or on-fix, whichever comes first.

Tokenomics

$STRX exists to make agent identity expensive to fake and dishonest execution expensive to attempt. It is a work token and a bond, not a payment rail — commerce settles in USDC, WETH and the assets being traded.

Supply and distribution

Protocol fee

Every settled intent pays 0.25% of settled notional, taken from the output leg inside the settlement transaction. There is no fee on rejected, failed or expired intents, and no fee on simulate_only calls. Subscription tiers in Rate limits & pricing are separate and buy throughput, not lower fees.

settled notional        $1,500.00
protocol fee  0.25%     $    3.75   taken from the WETH output leg
  ├─ treasury    40%    $    1.50
  ├─ stakers     30%    $    1.125
  └─ buyback     30%    $    1.125  → TWAP buy, burn, receipt emitted
solver fee (quoted)     $    0.90   paid by the solver's own margin, not added on top
agent receives                       output − 3.75 USD equivalent, ≥ quoted minimum

Staking and registration bonds

Two distinct locks use the same token and must not be confused.

Solvers post a separate bond sized to their maximum in-flight quote exposure, with a floor of 50,000 $STRX. A solver whose bond falls below its exposure is excluded from the auction until it tops up.

Slashing conditions

Slashing is executed by the StakingBond contract. Everything except the deterministic onchain cases passes through a 7-day challenge window in which the accused can post evidence; an unchallenged claim executes automatically, a challenged one goes to governance.

Networks & contracts

Nothing is deployed to mainnet. Registry and settlement contracts run on three EVM testnets; four more networks are queued behind them. EVM contracts deploy with CREATE2 from the same factory, so every EVM chain will share one address per contract. Solana runs a separate program set.

Deployment status

The target set is seven networks. Where a contract exists today it exists on a testnet, and it is redeployed without notice. Treat every row below as the current state, not a roadmap.

Use a strx_sk_test_ key against anything above. strx_sk_live_ keys exist in the key schema but have no mainnet to address, so they are rejected everywhere today.

Contract addresses

There are none to publish. No Strix Hood contract is deployed to any mainnet, there is no $STRX token contract, and the testnet deployments are not stable enough to pin. Addresses will appear in this table, in @strixhood/sdk/deployments.json and on the repository release tags at the same time — never one before the others.

Rate limits & pricing tiers

Subscription tiers buy throughput and support. They do not change the 0.25% protocol fee, and they do not change what a policy allows. Nothing is billable today — testnet runs on the Sandbox tier and it is free.

Tiers

The limits are real and enforced now; the prices are not set. Paid tiers are priced at mainnet, and no card is taken before then. Overage on intents per month will be billed per intent rather than blocked, so a traffic spike degrades your invoice and not your agents. Overage on requests per minute is never billed — it is rate limited.

Rate-limit headers

Every response carries the current window state. Read them; do not guess.

HTTP/1.1 200 OK
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 574
X-RateLimit-Reset: 1786953600
X-Request-Id: req_01JQ8ZT6P0Q2S4U6W8Y0A2C4E6
Strix-Api-Version: 2026-07-01

Bursts and backoff

The limiter is a token bucket refilled continuously at limit / 60 per second with a burst capacity of limit / 4. Short spikes pass; sustained overload does not. On 429, back off with full jitter and honour Retry-After.

async function withRetry<T>(fn: () => Promise<T>, tries = 5): Promise<T> {
  for (let attempt = 0; ; attempt++) {
    try {
      return await fn();
    } catch (err: unknown) {
      const e = err as { status?: number; retryAfter?: number };
      const retryable = e.status === 429 || (e.status ?? 0) >= 500;
      if (!retryable || attempt >= tries - 1) throw err;
      const ceiling = e.retryAfter != null ? e.retryAfter * 1000 : Math.min(2 ** attempt * 250, 8_000);
      await new Promise((r) => setTimeout(r, Math.random() * ceiling));
    }
  }
}

FAQ

Glossary

Agent

Protocol-side identity of an autonomous actor: a smart account, one bound policy, session keys, a reputation score and a slashable bond.

Asset diff

The signed before/after balance delta produced by simulation. The intent is only signed if the diff matches what the intent claimed.

Attestation

An EAS record binding intent hash, policy hash, simulation digest, solver identity and receipt. The audit artefact.

Bond

$STRX locked against an agent passport or a solver's exposure, slashable under the conditions in Slashing.

CAIP-2

Chain-agnostic identifier standard, e.g. eip155:8453. Used everywhere a chain is named.

Execution

The object created when an intent enters routing. Holds quotes, fills, transaction hashes and the attestation.

Fill

One settled portion of an intent. An intent without partial_fill has exactly one.

HITL

Human in the loop. The policy clause that escalates an intent to a person before signing.

Intent

A declarative, expiring statement of a desired outcome with no calldata and no route.

Notional

USD value of an intent at simulation-time prices. The unit all policy limits are denominated in.

Passport

ERC-721 token that carries an agent's identity, level, traits and revenue rights.

Policy hash

keccak256 of the domain-separated, RFC 8785 canonicalised policy document. Committed onchain, embedded in session keys.

Route preference

The objective the solver auction optimises: price, speed, gas or privacy.

Session key

A short-lived signing key with a permission blob: selectors, value ceiling, chain, expiry and the policy hash it was issued under.

Simulation

Fork execution of the candidate path against the pending block, with state overrides, producing the asset diff.

Solver

A bonded third party that competes to fill intents and is contractually bound to the output it quoted.

ULID

The lexicographically sortable identifier format used for every object ID, which makes IDs usable as pagination cursors.

User operation

The ERC-4337 transaction envelope signed by a session key and validated by the account's validator module.