Agent rotation
Replacing an agent's key without recreating the vault, so an old key permanently loses authority.
Agent rotation replaces an existing agent's key with a new one on the same vault, under an owner-signed covenant operation. After rotation, the old key has no further spending authority on that vault — permanently and unconditionally, enforced by the covenant, not by the application choosing to stop trusting it.
Why rotate instead of just "stop using" an old key
Simply no longer sending requests through an old agent key is not the same as revoking its authority: if that key were compromised, an attacker could still construct and submit valid transactions directly against the covenant using it, up to whatever authority was last configured for it. Rotation is the actual on-chain mechanism that removes an old key's authority.
What carries over, and what does not
Rotating an agent's key can preserve or change its policy independently — you can rotate to a new key with the exact same per-transaction limit, budget, and allowlist, or use the rotation as an opportunity to tighten or loosen those limits at the same time, all in one owner-signed operation.
Typical reasons to rotate
- Replacing a departing employee's or service's key with a new one.
- Responding to a suspected (but not yet confirmed) key compromise, as a faster alternative to full vault recovery.
- Rotating credentials periodically as routine operational hygiene.
- Swapping which specific AI agent instance or service account holds delegated authority.
Multi-agent vaults
On a vault with multiple independent agents, rotating one agent's key has no effect on any other agent's authority — each agent's policy is tracked and authenticated independently.
See also: Rotate an agent for the how-to, Pause/revoke for an immediate stop-gap, Owner recovery for a full withdrawal.