What wallets and signers do

The signer boundary — where all key custody and signing actually happens, and how PolicyVault stays signer-agnostic.

Every signature that matters in PolicyVault — owner operations, agent spends, approver approvals — is produced by an external signer: a wallet or equivalent key-holding component that PolicyVault never has access to.

#The signer contract

PolicyVault's application logic never branches on which wallet provider is connected; every signer implements the same generic contract: signInputs(unsignedTransaction, signInputs[]) -> signedTransaction. PolicyVault builds an exact unsigned transaction, tells the signer which specific inputs need signatures, and receives back the same transaction with those signatures attached — nothing about the signer's internals (browser extension, hardware device, offline/air-gapped process) changes this contract.

#Production signer today: KasWare

KasWare is the one production browser signer integrated today. PolicyVault's signer boundary is deliberately generic — the Universal Signer Interface — so other signers (mobile wallets, hardware devices, air-gapped signers, institutional custody platforms, automated agent signers) can be added without changing any funds-critical logic. An offline CLI signer reference already exists as a non-browser example of implementing the same interface.

#What a signer's approval actually authorizes

A signer signs the exact named inputs of an exact, already-frozen transaction — never a blanket authorization, never "whatever PolicyVault asks for next." The exact fee, amounts, and recipients are fixed before the signer is ever invoked, specifically so the signer only has to sign once and the thing it signs cannot be quietly altered afterward.

#Errors are normalized, never provider-specific

Signer failures — the wallet isn't installed, the user rejected the prompt, the wrong network is selected, an unsupported signing operation, an invalid response — are normalized to a fixed, closed set of error categories. Funds logic never branches on a provider-specific error string, which keeps behavior consistent regardless of which signer is connected.

#Network and account discipline

PolicyVault verifies the signer's selected network against the server's configured network on every connection and on every network-change event — a mismatch disables signing controls and discards any in-progress request rather than silently retargeting it. Switching accounts likewise discards any in-progress request; an old signature is never reinterpreted for a different account.

See also: What KasWare signs, Connect KasWare, KasWare signing problems.