DocsAI agents
Agent wallets and limits
Each agent signs with its own Privy server wallet. Privy's policy is the first lock, the contract is the second and deciding lock.
#The agent's own wallet
Every agent has its own Privy server wallet. It is created under the worker's key quorum, so:
- the web app can create an agent's wallet, but holds no key that can sign for it
- the worker holds the quorum's authorization key, in its own environment only, and is the only thing that can sign for an agent
An agent never holds an owner key. It is a spender like any other: it can pay within its own policy, and the contract would let it file a request for itself (the worker does not file requests yet). It cannot raise its own limits, approve a service, approve a request or choose a payee.
#Lock one: Privy's policy
Each agent wallet carries a Privy policy that allows exactly two kinds of transaction, and refuses everything else before signing:
| Allowed | Conditions |
|---|---|
pay on its own account | Sent to that account, on that account's chain, with no native value, and an amount above 0 and at most the agent's cap per payment. With no cap, any amount above 0 |
request on its own queue | Sent to that queue, on that chain, with no native value, naming the agent itself as the spender |
There is no rule for anything else, so Privy refuses it: token transfers, other contracts, message signing, paySettled, and every owner function. If the worker were compromised, it still could not make an agent's wallet sign anything but a bounded payment or a request from that agent's own account.
#Lock two: the contract
Privy's policy does not know the agent's allowance, approved services, payment count or expiry. The account contract does, and it checks all of them on every payment, along with the agent's status and the account's pause. The contract is the authority. Privy's policy is defence in depth.
#No MON needed
When the worker runs with sponsored sends on, every agent payment is sent through Privy with the gas paid by Nuntio, and the agent's wallet needs no MON. The agent's page says who pays its gas, from the worker's own report. If the worker's report cannot be read, the page says so rather than guessing.
On mainnet the first agent payment came from a wallet with a MON balance of 0. The contract saw the agent's wallet as the spender, not the bundler that submitted the transaction.
#On mainnet
The mainnet worker uses Privy server wallets as agent signers. It refuses to start with a raw private key as an agent's signer unless that is explicitly allowed. A mainnet agent's Privy policy pins chain 143 and the mainnet account and queue.
#What bounds an agent, in the worst case
An agent can never pay more than its allowance in one period, more than its cap in one payment, more than its number of payments, after its access ends, or to a service not on its list. Every payment goes to the payee the registry names for a registered, active service. The owner can pause or revoke it at any time, and the contract refuses its next payment.