Give an AI agent spending authority
Grant a new or existing agent a bounded, covenant-enforced ability to spend from a vault.
This applies equally whether the "agent" is a person, an automated backend service, or an AI agent driving requests through the Agent API, MCP server, or an SDK — the covenant does not distinguish between them.
What you need before you start
- An existing vault (see Create your first vault).
- The agent's public key or wallet address. For an AI agent or automated service, this is a keypair your infrastructure controls — PolicyVault never generates or holds it for you, and it is never a seed phrase or private key you hand to PolicyVault.
- A decision on the policy: per-transaction limit, periodic budget and period length, an optional destination allowlist, and an optional approval threshold with a set of approvers.
Steps
- From the vault's page (or via the API's agent/policy management route), choose to add or configure an agent.
- Enter the agent's address or public key.
- Set the per-transaction limit — see Per-transaction limit.
- Set the periodic budget and period length — see Set a periodic budget.
- Optionally attach a destination allowlist — see Create an allowlist. Without one, the agent may pay any valid recipient within its other limits.
- Optionally set an approval threshold — see Require approvals. Without one, the agent's spends within its other limits never require additional approval.
- Review and sign. This is an owner-signed covenant operation: only the vault owner's wallet can grant or change spending authority.
Start conservative
There is no requirement to grant broad authority up front. A common pattern for AI agents in particular is to start with a small per-transaction limit and a small periodic budget, confirm the agent behaves as expected over real (small) spends, and widen the policy later — each widening is itself an explicit, visible, owner-signed operation, never a silent default.
Verifying it worked
After the operation confirms on-chain, the agent's policy is visible on the vault's page and can be independently checked with a simulated spend request before any real funds move.
See also: Agent/Delegate, Rotate an agent.