Create an allowlist

Restrict an agent to a specific, covenant-committed set of recipient addresses.

#When to use this

Use a destination allowlist whenever an agent's legitimate spending should only ever go to a known, fixed set of recipients — recurring vendor payments, a payroll list, a specific set of service invoices an autonomous agent is allowed to pay. An allowlist turns "the agent's key was compromised" from "funds can go anywhere" into "funds can still only go to the recipients you already approved."

#Steps

1. Gather the exact recipient addresses you want to allow. Double-check each one — an allowlist is only as good as the addresses actually on it, and adding or removing entries later is a new owner-signed operation, not a quick edit.
2. From the vault's (or agent's) policy configuration, enter the recipient set to be committed as the allowlist.
3. Review and sign. PolicyVault builds the cryptographic commitment (a Merkle root) over the recipient set and submits an owner-signed covenant operation that binds it to the agent's policy.
4. Confirm on-chain. Once confirmed, any future spend by that agent to a recipient outside this set is refused by the covenant itself — not merely discouraged by the application.

#Updating the allowlist

Adding or removing a recipient requires rebuilding and re-committing the set, as another owner-signed covenant operation. There is no way to append a single address without the owner signing the update.

#Verifying it

Use simulation to confirm a spend to a non-allowlisted address is correctly refused, and a spend to an allowlisted address proceeds normally, before relying on it for real funds.

See also: Destination allowlist, Destination not allowed.