How should an AI agent hold custody?

The short version: a trading agent gets a dedicated key funded with only its mandate, signs bounded EIP-712 orders instead of open-ended transactions, and operates behind signer-enforced policy: token allowlist, notional caps, expiry, an independent price check, and the receiver pinned to the owner. For the strongest setup, a smart account enforces the policy on-chain. Log every signed payload.

Should an AI agent have its own wallet?

Yes, a dedicated one. Give the agent its own signing key, funded per mandate with only what its job needs, and keep it strictly separate from treasury or personal keys. If the agent misbehaves or its host is compromised, the exposure is the mandate, not everything the operator owns.

What limits the damage if an agent is compromised?

Layers, each enforced outside the model. Bounded orders cap what one signature can do: sell token, buy token, amount, a hard limit price, an expiry, and the receiver pinned to the owner. The signer's policy caps what the agent may attempt at all: a token allowlist, notional caps per order and per period, and an independent price check so a manipulated quote cannot set an absurd limit. None of these makes a compromised agent safe; together they turn a catastrophe into a bounded loss.

Why is the receiver field the first thing to pin?

The receiver says where bought tokens go. An agent that signs an otherwise-correct order with an attacker's receiver has lost the funds even though the price was fair, which makes an unpinned receiver the top drain vector for an automated signer. Pin it to the owner and assert it in code before signing; the @ophis/sdk ships assertReceiverIsOwner for exactly this.

Can a smart account enforce policy on-chain?

Yes, and it is the strongest layer because it binds even a fully compromised agent process. A smart account such as a Safe can hold the funds while a policy module restricts what any session key or module may do: which tokens, which contracts, what size. The agent then proposes, and the account enforces. Ophis publishes a vault policy module for exactly this pattern in curated-vault contexts.

What should be logged?

Every signed payload, before it leaves the signer. When something goes wrong you want to reconstruct exactly what the agent signed and when, not what the model claims it did. Logs of unsigned proposals that policy rejected are just as valuable: they are your early warning that the agent is being steered.

Go deeper

The full policy checklist lives at docs.ophis.fi/agent-wallet-policies, and the order-level pattern in AI agent token swaps: the safe pattern. Why signed orders beat exchange API keys for agents: API keys vs wallet signatures. The custody model overall is on the security page.