An agentic wallet, and what stops it.
A wallet an AI agent can spend from without asking you each time. Every product in this category says it has limits. What separates them is where those limits are enforced, and what the agent is able to express in the first place.
The definition, and the part that matters
An agentic wallet is an account an AI agent can act from on your behalf, inside bounds someone set in advance. That is the easy half.
The hard half is the second clause. What the bounds are, and what enforces them, is the entire design — and the answers differ far more than the marketing suggests. A cap held in an operator’s policy engine and a cap fixed in an account only you control are both called a spending limit, and only one of them survives the operator having a bad day.
Three ways to build one
The agent holds a key, and software asks it to behave. The agent holds part of a key, with a policy engine deciding what gets co-signed — the dominant commercial answer. Or the agent holds no key at all.
This is the third. The agent is a contract your account appoints; a plain key cannot be appointed. It fills a fixed form drawn from a closed catalogue of operations, and there is no field for a destination address — destinations are roles resolved from your account when a step runs. A persuaded model cannot write down “send it to me”, so nothing has to catch it trying.
Account abstraction is why any of this is possible
An ordinary wallet is one address controlled by one private key, and that key is all-or-nothing. Account abstraction makes the account a contract instead, so the rules about who may do what are code.
That is what lets an account appoint a contract rather than hand out a key, scope a permission to named operations with a cap per asset and per period, and let someone else pay the network fee. The standards are ERC-4337 for the account and ERC-7579 for the permission modules. You never need to meet those numbers to use this.
What we will not claim
The guard works as a list of banned actions rather than a list of permitted ones. It completely blocks a takeover and it does not block every way value could move through an action nobody thought to ban. We have proven four such attacks against ourselves. There is no external audit.
Three chains, nine protocols. If that is not enough for what you are doing, none of the rest matters.
Bring one strategy you are tired of running by hand.
We onboard a small number of funds and operators each month, and we sit with each one to build their first loop.