Policy and permissions
The policy is the agent's entire authority. It is configured in Core Web (Settings → AI connectors), stored server-side, and — critically — signed by your wallet, so the server can verify it wasn't tampered with and nobody but you can loosen it.
The four constraints
| Constraint | Options | Effect |
|---|---|---|
| Accounts | All, or a selected set | Which accounts appear in list_accounts and may sign |
| Networks | All, or a selected set (stored as CAIP-2, e.g. eip155:1) | Where transactions may be sent |
| Spend limit | Unlimited, or a USD amount | Cap on total value an agent may move per session |
| Recipients | Everyone, or an allowlist | Which destination addresses transactions may target |
Plus the master switch: enabled/disabled. Disabled means every tool call fails, valid OAuth token or not — it is the fastest way to cut an agent off.
A sensible starting policy
Grant the minimum that makes your use case work:
- Accounts: one dedicated agent account, funded with what you're comfortable automating — not your main holdings.
- Networks: just the ones the agent needs.
- Spend limit: low, and raised only when a workflow proves out.
- Recipients: your own addresses and known contracts via the allowlist, with custom recipients added one at a time.
Changing the policy
Edits happen only in Core Web and each save requires a fresh wallet signature. Agents cannot see or modify the policy — they only experience its effects as allowed and refused calls, which you can audit in the activity log.