Loading…
Production-posture use case
Built and operated by an affiliate of the Decionis founding team.
Nevarn refuses a trade when the authority cannot be reached
Nevarn runs automated trading for people who will never manage a private key, under a permission they grant and can take back without Nevarn’s cooperation. The category asks customers to trust an opaque bot with custody of their funds; Nevarn is built the other way round. The money and the machinery are separate, every permission is bounded and expiring, and before a strategy acts it has to ask something other than itself.
That something is Decionis. The part worth reading twice is the failure direction: when the authority is unreachable, Nevarn does not fall back to its own judgement. It refuses the trade. An outage stops trading rather than quietly removing the guardrail, and that choice is the live configuration, not an aspiration.
What Nevarn asks before it acts
Every trade is described in full and submitted for a ruling before it is placed:
- the market and the direction
- the size
- the price Nevarn currently sees, and how stale that price is
- the collateral available
- the positions already open
Four answers can come back — proceed, refuse, refer to a person, or hold — and only proceed releases the trade.
How the money is protected
This has to be true before anything else matters, which is why Nevarn puts it first.
Two accounts, not one
A customer has a wallet that holds their money and a separate working balance. Nevarn can act for the working balance only and is structurally prevented from ever being granted permission over the wallet. The amount moved across is the amount at risk, and the customer chooses it.
Every permission is bounded
Where it may act, what it may do, a ceiling on each transaction, a rolling daily limit, and an expiry. Every rule refuses by default: a missing limit denies rather than permits, and a permission cannot be created without an allowlist at all.
One control stops everything
A single action halts all signing on an account, effective on the next request — not a support ticket.
Revoking destroys the thing that could sign
Only the customer installs a permission and only the customer removes it. Revocation is not a flag in a record; the material that could produce a signature is deleted, and when Nevarn's records and the blockchain disagree, the blockchain wins.
Where Decionis sits
Ask something other than yourself
Before an automated strategy is allowed to act, it must ask permission from something other than itself. Nevarn assembles the description of the trade and submits it to Decionis for a ruling. Four answers can come back in Nevarn's terms — proceed, refuse, refer to a person, or hold — and only proceed releases the trade. In Decionis's terms, only an allow does.
Unreachable means refused
If the decision service cannot be reached, the trade is refused, not waved through. That is the safe failure direction, and it is how the live configuration is set: an outage stops trading rather than quietly removing the guardrail.
An approval is bound to one exact trade
When an approved instruction reaches the venue, it is independently re-checked against the approval it carries. Change any parameter and the approval no longer matches; it cannot be reused on a different order.
The authority sees enough, and no more
Wallet addresses, account references and transaction hashes are replaced with keyed stand-ins that mean nothing without Nevarn's key; balances and timestamps leave as an order of magnitude and an hour. Decionis sees enough to judge the trade and nothing that identifies the customer.
Where the gate is armed today
Being precise about this matters more than being impressive about it.
| Strategy | Gated |
|---|---|
| Prediction-market arbitrage — buying | Enforcing |
| Prediction-market cash-out — selling a position deliberately | Enforcing, same authority and configuration as buying |
| Contracts and currencies, including position exits | Built and tested; switched off until the same authority covers them |
What this proves, and what it does not
It proves that a production system moving real funds can run Decionis in enforcement with fail-closed as the live configuration, bind each approval to one exact action, and do so without handing the authority any customer identifiers. It does not prove returns, volumes, or outcomes — none are claimed here, and no figure on this page is a measured result. Those numbers are Nevarn’s to publish.
Published with Nevarn’s written consent · approved by Festus Jejelowo on 2026-09-25.