> ## Documentation Index > Fetch the complete documentation index at: https://docs.tiprotocol.io/llms.txt > Use this file to discover all available pages before exploring further. # System overview > Ti Protocol has four layers. The top two handle information, and the bottom two move funds only after the user's wallet signature. Ti Protocol consists of four layers, plus a token and governance layer that sits beside them. The top two layers handle information. The bottom two take the user's signature and move funds. This chapter explains what each layer does and how a single user question passes through them. L1**Conversation**Ti AIL2**Quote**Ti quote APIAbove this line: information. Below it, nothing moves without the user's wallet signature.L3**Execution**User walletCross-chain routerL4**Settlement**BridgesDestination receiver**Token & governance**![](https://mintcdn.com/ti-protocol/nfbzCVnO_pXa92Aq/images/src/icons/chain-polygon.svg?fit=max\&auto=format\&n=nfbzCVnO_pXa92Aq\&q=85\&s=bf063a32b1ab85f85d42f8cbfcbac3b5)PolygonSeparate from the swap path. Swapping never requires TIP.View figure full size **Figure 8.** The top two layers only handle information; the bottom two move funds only after the user's wallet signature. *** ## 1. Four layers The **conversation layer** is home to Ti AI. It understands a question typed in everyday language, chooses and calls the tools needed to answer it, and turns what the tools return into cards and a short answer. It answers in the language of the question and has no function for creating or executing transactions. The **quote layer** is the Ti quote API and its data services. Given a pair and an amount, it finds pools within the same chain, multi-hop routes and cross-chain routes, and calculates the amount received for each candidate. This layer also handles prices, liquidity pool data and transaction status lookups. Ti AI and the swap screen use the same quote API, so the reference quote the AI shows and the quote on the swap screen come from the same engine. The **execution layer** is the user's wallet and the execution contracts deployed on each chain. A transaction the user signs goes to a DEX router if it stays within one chain, or to the cross-chain router if it crosses chains. When needed, the cross-chain router swaps first on the source chain, then hands the tokens and a message to the bridge. With Gasless mode on, a relayer submits the transaction carrying the user's signature and pays the network fee. The **settlement layer** is the bridges that connect chains and the receiving contracts on destination chains. USDC moves through Circle CCTP, and USDT moves as USDT0, which is built on LayerZero OFT. The receiving contract on the destination chain takes the tokens that arrive through the bridge, swaps them once more into the target token if needed, and sends them to the user's wallet. The Ti explorer tracks how far each transfer has progressed. The **token and governance layer** lives on Polygon mainnet. It consists of the TIP token, seven vesting contracts, the AccessManager permission contract (OpenZeppelin AccessManager) and multisig Safes. This layer is separate from the path users' swaps take. You do not need TIP to swap, and TIP's administrative functions do not interfere with users' swaps. *** ## 2. The path of a single swap Let us follow a user who asks, “How much will I get if I swap 1,000 USDC on Base for USDT on Arbitrum One?”
  1. 01**Ask**UserTi AI“What do I get for 1,000 USDC on Base as USDT on Arbitrum One?”
  2. 02**Quote**Ti quote APIFinds candidate routes, compares amounts received
  3. 03**Review**UserRoute, fees, minimum received
Steps 1–3Ti AI helps
  1. 04**Sign**User walletApproves after checking chain, token, amount
  2. 05**Move**BridgeBurn on the source chain, mint on the destination
  3. 06**Arrive**Ti explorerConfirms receipt on the destination chain
Steps 4–6the user's signature and the chain's rules decideView figure full size **Figure 9.** A cross-chain swap takes six steps, and funds move only after the wallet signature in step 4. **1. Ask** From the question, Ti AI reads the source chain (Base), the token sent (USDC), the amount (1,000), the destination chain (Arbitrum One) and the token received (USDT), and calls the quote lookup tool. **2. Quote** The quote API builds candidate routes. Here, the typical route carries the USDC on Base as it is over CCTP to Arbitrum One, then swaps it to USDT in a pool there. For each candidate, the API calculates the bridge fee and the result of the swap on the destination chain, and compares candidates by the amount received. **3. Review** Ti AI shows a quote card. The card lists the route, the route fee (reflected in the amount received), the amount received, and the source and timestamp. To proceed, the user moves to the swap screen. The swap screen fetches a fresh quote and shows the route, price impact and minimum received again. **4. Sign** The user checks the chain, token address, amount and fees shown in their own wallet, and signs. This is the only step that moves funds. **5. Move** The cross-chain router sends the USDC to CCTP. The USDC is burned on Base, and once Circle attests to the burn, USDC minus the bridge fee is minted on Arbitrum One and goes to the destination receiver. The destination receiver swaps the USDC to USDT, on condition that it meets the minimum received set at signing, and sends it to the user. **6. Arrive** The user can check progress in Ti using the transaction hash, and the swap is marked complete when the USDT arrives on Arbitrum One. In this flow, Ti AI is involved only in steps 1 to 3. From step 4 on, the user's signature and the rules of the blockchain decide everything. *** ## 3. Trust boundaries The table below sets out what each component can and cannot do. | Component | What it can do | What it cannot do | | - | - | - | | Ti AI | Understand questions, call tools, look up public data and reference quotes, produce cards and summary answers | Create, sign or execute transactions, generate transaction data for signing, ask for seed phrases or private keys | | Quote API | Search candidate routes, calculate amounts received, prepare route data for the transaction | Move user funds, change the minimum received or deadline the user signed | | User wallet | Display transaction details, sign | Sign anything the user has not approved | | Cross-chain router and DEXs | Execute signed transactions, check minimum received and deadline | Execute outside the signed conditions | | Gasless relayer | Submit transactions carrying a signed message, pay the network fee on the user's behalf | Change the swap assets, amount, recipient address, minimum received or fee cap | | Bridges (CCTP, USDT0) | Burn or lock on the source chain, verify, mint on the destination chain | Mint outside each protocol's verification structure | | TIP and vesting administrative functions | Operations and compliance actions within a defined scope (under multisig and time delays) | Additional minting, upgrades, admin withdrawals, shortening a schedule that has started | The most important rows in this table are the first row and the two below it. However much the information-side components do, nothing happens unless the user signs. And the moment the user signs, the key conditions of the transaction (token received, minimum received, recipient address, deadline) are locked in. Information**Ti AI***Can*Understand questions · call tools · look up reference quotes · cards and summaries*Cannot*Create, sign or execute transactions · ask for seed phrases or keys**Quote API***Can*Search routes · calculate amounts received · prepare route data*Cannot*Move funds · change the signed minimum or deadline**User wallet***Can*Display the transaction · sign*Cannot*Sign anything the user has not approvedLocked the moment the user signsExecution after signing**Cross-chain router and DEXs***Can*Execute signed transactions · check minimum and deadline*Cannot*Execute outside the signed terms**Gasless relayer***Can*Submit the signed message · pay the network fee*Cannot*Change assets, amount, recipient, minimum or fee cap**Bridges (CCTP · USDT0)***Can*Burn or lock · verify · mint on the destination*Cannot*Mint outside the protocol's verification**TIP and vesting admin***Can*Scoped operations and compliance actions (multisig, time delays)*Cannot*Mint more · upgrade · admin withdrawal · shorten a started scheduleView figure full size **Figure 10.** Whatever the information side does, no funds move until the user signs, and signing locks the key terms of the transaction. *** ## 4. Off-chain and on-chain responsibilities Route search happens off-chain. Reading the state of dozens of pools and calculating the result of every candidate route on the blockchain would cost too much gas and take too long. Instead, so that a route chosen off-chain cannot execute against the user, the conditions that protect the result are checked on-chain. * **Minimum received** If the user would receive less than the minimum received calculated from their slippage tolerance, the transaction fails. In a cross-chain swap, a separate minimum received applies to the bridge leg and to the destination-swap leg. * **Deadline** The signature includes a deadline, and a transaction past its deadline does not execute. * **Recipient address** The address that receives the output is fixed in the transaction data. * **Signature verification** In Gasless transactions, the execution contract executes only after it has verified the user's EIP-712 signature. With this split, even if an off-chain component is wrong or under attack, the damage is capped by the conditions the user signed. If the quote API produces a bad route, the transaction simply fails the minimum received check. It does not end in an outcome the user did not agree to. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.