Give an agent a job, not unlimited authority.

Agents can be wrong, or be manipulated. Give an agent a job and a key — the account still enforces which roles, actions and destinations that key may use.

Scope an agent’s role How pre-execution checks work

Where control breaks today

A prompt isn’t a permission.

Agents and automations are given real work with real assets — usually through a key that can do far more than the job requires.

The agent holds a full key

Whatever the agent is meant to do, its key can do anything the account can.

Shared keys hide who acted

When an agent signs with a team key, nobody can tell its actions from a person’s.

A prompt injection becomes a transaction

Manipulated input can turn into a signed, valid operation.

Revoking access means rotating keys

Taking authority away from one agent can mean moving everything else.

In practice

Let an agent claim rewards — and nothing else.

The agent may claim rewards. Told to withdraw the stake, it’s refused.

What you set up

A dedicated wallet for the agent
A role that can only request
The staking contract — claim only
Approval kept with people

Set up agent-assisted requests, step by step (opens in a new tab)

Agent asks
to claim

A person
approves

Rewards
claimed

Agent asks
to withdraw

Refused

Illustrative

The approach

Scope the authority, not just the instructions.

Treat an agent like any other participant: its own identity, and only the permissions its job needs.

Its own key and identity

Each agent signs with its own address, so its actions are attributable — and can be switched off on their own.

Request-only by default

Give the agent the one step its job needs — usually requesting. Approving and submitting stay with people.

Only the functions you list

The account calls only the contracts and functions on its lists — claim, but not withdraw — whoever signs.

Revoke the role, not the account

Remove an agent’s authority without moving funds or rotating everyone’s keys.

Before you let it act

What the account enforces — and what the agent still decides.

The account enforces the authority you grant. What the agent does inside that authority is still its — and your — responsibility.

Enforced by the account

The role and steps granted to the agent’s address
The address and contract lists, whatever the agent signs
Approval by a person, where you require it
An on-chain record of each operation

Your responsibility

Mistakes the agent makes inside its granted scope
The agent’s instructions, inputs and model behaviour
Monitoring and incident response
Protecting the agent’s signing key

Give one agent one scoped role.

We’ll help you define what it should be able to do — and test what happens when it tries something else.

Talk to us Bloxchain Protocol