Safe enough to
hand an agent.
An agent that can act on your portfolio is only a good idea if the worst it can do is bounded, visible, and something you can stop. Three things make that true here: what a grant is allowed to say, where signatures are produced, and what you can take back.
An agent never gets your account.
It gets an allowance — a grant that names a protocol, an action, an asset and a ceiling.
Anything outside that description is not something the agent chooses not to do; it is something the grant cannot express.
This is the difference between reviewing every transaction and reviewing the rules once. You read a grant when you make it, and after that the agent works inside it.
How grants are enforced →Signatures are produced inside a confidential VM.
That VM publishes an attestation: a signed statement of exactly which image it is running.
Nothing is trusted with a key until that statement has been checked against the image that is supposed to be there.
The point is not that hardware is magic. The point is that “is the right code running?” becomes a question with a checkable answer instead of a promise.
The architecture in full →Four things you can check.
What a grant may say, what it may cost, how it ends, and where the signing happens.
An allowance is typed.
Not an approval for “this token, unlimited”. A grant names the protocol, the action and the asset, so an agent that was given a swap cannot use it to withdraw.
An allowance is capped.
Every grant carries a number. The cap is the worst case — the most the grant can cost you if everything downstream of it behaves as badly as it can.
An allowance is revocable.
A grant can be cut off without moving funds, rotating a key, or asking the agent to co-operate. Revocation is a decision you make alone.
Signing happens in attested hardware.
The signer runs inside a confidential VM and reports what image it is running. That report is checked before it is trusted with anything — so “the right code is running” is something you verify, not something you are told.
Read the rules before you grant them.
The documentation is the same description the code enforces — not a summary of it.