How to revoke the agent in one transaction

Ask any automated-execution product how you turn it off. The answers sort into three groups, and only one of them is a mechanism.

A dashboard toggle is a request to a system you do not control. If that system is down, compromised, or simply disagrees with you, the toggle is decoration.

How it works here#

One transaction, from your own wallet, to your own account. It removes the agent’s appointment.

That is the whole thing. You do not open a ticket, you do not wait for us, and there is no step where our cooperation is required — or even possible.

The three properties that make it real#

1. It is checked on every call, not per cycle

   The agent verifies the appointment each time it acts. There is no window where a plan already in flight keeps running on a stale permission. Revocation takes effect at the next call, which is to say immediately.

2. It needs nobody's cooperation

   The account answers to your signature alone. No co-signer, no guardian approval, no timelock, no operator acknowledgement. If every server we run went dark, revocation still works, because it is a transaction to a contract.

3. It is one-way

   Your account can never be re-pointed at a different agent. The first appointment binds, and the only permitted change is to none at all.

That third one deserves more than a bullet.

Why the appointment is one-way#

An account whose agent can be swapped has a role in it — whoever can perform the swap. That role is a target. It does not matter how carefully it is guarded; its existence is the problem, because every guarantee about what the agent may do becomes a guarantee about what the current agent may do.

So: you can appoint once, and you can revoke. You cannot be migrated to a new agent, by us or by anyone who compromises us. If we ship a new agent contract, you opt into it deliberately, with a new account — not by us redirecting the one you have.

What revocation does not do#

It stands the agent down. It does not unwind your positions.

This trips people up in a stressful moment, so it is worth rehearsing: if your intent is “stop and get flat”, that is two actions, and only the first is instant.

What you keep the entire time#

The mandate you granted the agent does not gate anything you do. At every point, with the agent live or revoked:

You are the sole owner, unilaterally, 100% of the time. “Non-custodial” is not a posture here; it is the reason none of the above needs our permission.

Test it on day one#

Genuinely. Appoint the agent, run a trivial plan, revoke, and confirm the next scheduled run does not fire. It takes ten minutes and two gas fees.

A recovery path you have never exercised is a recovery path you are guessing about. That is true of every system, and it is most true of the ones whose marketing pages have a section like this one.

The bound we cannot raise#

One last property, because it is the other half of the same idea. Caps are fixed in your account: per asset, per period.

Nothing on our side can raise them. Not an admin key, not a migration, not a support override — the check lives in your account and the account only answers to you. If the cap is 500 USDC a month, the worst case for a fully compromised agent is 500 USDC a month, until you revoke.

That number is the actual answer to “what is my exposure”, and it is a number you set.