Rotate an agent
Replace an agent's key with a new one, so the old key permanently loses spending authority.
When to use this
Rotate an agent's key when replacing a departing employee's or service's credentials, responding to a suspected (not yet confirmed) key compromise, or simply as routine credential hygiene.
Steps
- Generate or obtain the new agent key or wallet address. As always, PolicyVault never generates or holds a private key for you — that happens entirely in your own infrastructure or wallet.
- Decide whether the new key should carry the same policy (per-transaction limit, budget, allowlist, approval threshold) as before, or whether you want to adjust it at the same time.
- From the vault's agent configuration, choose to rotate/replace the agent's key, supplying the new key and (if changed) the updated policy.
- Review and sign. This is an owner-signed covenant operation.
- Confirm on-chain. Once confirmed, the old key has no further spending authority on this vault — this is enforced by the covenant, not by the application simply no longer using the old key.
After rotating
- Update whatever system (automation, service configuration, an AI agent's runtime credentials) was using the old key to use the new one.
- The old key remains a valid Kaspa keypair for anything unrelated to this vault — rotation only removes its authority on this specific vault's covenant.
If you suspect the old key is actively compromised
Rotation removes future authority immediately once confirmed on-chain, but consider pausing the vault first if you want to stop all spending (including from other agents, if any) while you investigate, then rotate once you've confirmed what happened.
See also: Agent rotation, Pause/revoke.