External Approver
Another wallet that may approve qualifying requests. An approver cannot spend vault funds or act as the owner.
An external approver is another wallet that may approve a spend request that qualifies for approval — typically because it exceeds an agent's approval threshold. An approver cannot spend vault funds or act as the owner.
What an approver's signature actually does
When a spend needs approval, the covenant requires signatures from a configured number of approvers (an "M-of-N" threshold — see Approval threshold) over the same exact frozen transaction the agent is trying to submit. An approver is not a transaction input signer in the way the owner or agent is; instead, the covenant checks each approval as a signature over the transaction's committed content. This means an approver is cryptographically endorsing one specific, exact transaction — the amount, recipient, and every other detail are fixed before an approver ever signs, and an approval cannot be reused for a different transaction.
What an approver cannot do
- Cannot initiate a spend.
- Cannot change vault policy, add or remove agents or approvers, pause the vault, or recover it.
- Cannot approve a transaction other than the exact one presented — there is no generic "approve this agent's future spending" grant.
- Gains no owner-level or agent-level authority of any kind, no matter how many approvals it has previously signed.
The approver's authority is deliberately narrow
This narrowness is a hard design invariant, not just a UI restriction: an approver's role in the system is to add a second signature requirement above a threshold the owner chose, nothing more. A hosted platform bug that mistakenly widened what an approver could see or do would be treated as a serious defect — see the note on the 2026-08-27 external-approver discovery fix in Approval not visible, which was exactly this kind of availability bug (an approver's own vault and requests briefly failed to appear to it), not an authority-widening one.
How an approver interacts with a vault
An approver only ever needs read access to the specific request awaiting its signature, and the ability to submit its approval signature. It does not need broader visibility into the vault's history or other requests unless the vault owner also gives it that access through unrelated, purely informational organization metadata (which, again, grants nothing on-chain).
See also: Add an external approver, Require approvals, Approval threshold, Approval states.