Agent / Delegate

A key the owner authorizes to spend from a vault, bounded by covenant-enforced policy.

An agent (also called a delegate in the covenant and SDK) is a keypair the vault owner authorizes to initiate spends from a vault, strictly bounded by the policy the owner set. An agent can be a person, an automated backend service, a bot, or an AI agent — the covenant treats them identically; there is no separate "AI" code path with different rules.

#What an agent can do

• Request and sign spends from the vault, up to the per-transaction limit and within the remaining periodic budget.
• Pay only recipients on the vault's destination allowlist, if one is configured.
• Spend without needing a separate wallet to cover network fees, when the vault uses a fee reserve (current covenant versions support multiple independent agents, each with its own policy, each drawing fees from the vault's own covenant-controlled reserve).

#What an agent cannot do

• Exceed its per-transaction cap or remaining periodic budget — the covenant rejects any transaction that tries.
• Pay a recipient not on its allowlist, if one is set.
• Change the vault's policy, add or remove agents, pause the vault, or recover it — those are owner-only operations.
• Inherit another agent's authority. In covenant versions that support multiple agents, each agent's full policy (key, caps, budget, period, recipient set, approval threshold) is bound together as one authenticated unit, so one agent's key cannot be used to exercise another agent's limits.
• Bypass approval requirements. If a spend exceeds the agent's approval threshold, the covenant requires the configured number of external approver signatures before it will accept the transaction — no matter who submits it or how.

#Why this holds even against a malicious or careless agent

The limits above are not enforced by the PolicyVault application asking nicely — they are enforced by the Kaspa covenant script itself. An agent that has its own private key and full knowledge of PolicyVault's internals gains nothing by skipping the app and hand-building a transaction: Kaspa consensus evaluates the same covenant rules regardless of how the transaction was constructed, and rejects anything outside policy.

#AI agents specifically

An AI agent using PolicyVault (through the Agent API, MCP server, or an SDK) is exactly an agent in the sense above: it can request spends and see what the deterministic core would decide (via simulation), but it never gains any authority beyond what the owner configured, and its output is never trusted as a policy decision — see the authority statement in What is PolicyVault?.

See also: Give an AI agent spending authority, Rotate an agent, Agent rotation.