Delegated agents
This guide describes the intended delegated-agent model. The published Wallet SDK has no public agent-lane issuance API. Its NEAR delegate-action signing API signs a transaction envelope and does not create delegated-agent authority.
Use the policies and mandates guide for the operation shape, then review shopping agents for a product example. Give each agent an independent subject and signing lane.
Grant narrow authority
- Authenticate the owner with fresh user presence.
- Describe allowed operations, targets, budgets, expiry, revocation, and human-approval rules in plain language and typed policy data.
- Assign the agent an independent identity.
- Verify the grant receipt.
- Route each agent operation through the same admission and audit boundary as normal signing.
Never copy a user's passkey, session token, private key, or unrestricted API credential into an agent. The owner wallet remains the payer. The agent's identity proves who requested the operation. Revoke a compromised agent lane independently from the owner wallet.
Read delegated agents for the security model.