Skip to main content
An AI agent is a first-class non-human principal in the money-movement control plane. It is not an LLM, and it is never the authorizer. The model that drives an agent proposes transactions. The mandate is the authority. The signing layer only completes signatures that cleared policy.
The LLM is an untrusted proposer. Authority lives in the mandate, evaluated by a deterministic engine with no LLM in the decision path. A proposal is only signed if it satisfies the agent’s policy.

​
An agent is five bound things

“Give your agent a wallet” means minting an agent as a scoped, revocable principal. An agent is exactly five bound things. Identity, wallet grant, and mandate scope what an agent is and what it may sign. Budget bounds how much it may move. Expiry closes the loop so no agent holds authority forever. An agent is addressed by a stable agentId; a managed or embedded assistant adds an assistantId. How it is selected, and why one organization runs many agents and assistants, are cross-surface invariants — see Choose your surface → Invariants.

​
Proposer versus authorizer

WalletSuite separates the actor that decides what to try from the function that decides what is allowed. These are different trust levels and they run in different places. The authorizer checks every proposal against your deny-by-default allowlist rules before any share is released, and records the decision. See Policy Gates for the rule model and Policy Decisions for the decision record. Because the model never authorizes, a poisoned prompt or a misaligned proposal cannot exceed the mandate. The worst an LLM can do is propose a transaction the engine denies.

​
How each surface carries authority

The mandate is the same object across every surface. Only the way an agent reaches it differs.

MCP

Agents connect to the hosted MCP server with a short-lived token. The tool profile bounds which tools exist in the schema, and the mandate bounds what a tool can do. The MCP layer proposes; it never authorizes.

SDK

Application code calls the SDK to construct and submit intents. The same mandate is evaluated on every signing request.

REST

Any language calls the REST API directly. The policy engine sits in front of the signing path, so the same authorization applies regardless of surface.
The mandate is a signing-layer control that applies to every surface. A narrow tool profile plus an armed mandate gives an agent the smallest possible tool surface and the smallest possible signing authority at once. See Architecture for how the three surfaces compose.