What Is AgentWallet? A Financial Identity Layer for AI Agents
AgentWallet gives AI agents a financial identity plus the spending and payout controls to transact safely on a person's behalf. Here is how it works.
AgentWallet is a multi-tenant platform that gives AI agents a financial identity plus the controls to spend and get paid safely on a human's behalf. An agent connects over the Model Context Protocol, authenticates with a scoped key, and operates inside spending limits and human approvals that cascade from the business account down to each individual agent.
Why AI agents need their own wallet
As AI agents move from answering questions to taking actions, many of those actions cost money: buying a subscription, paying an API bill, or sending a payout. Handing an agent a raw credit card or an unrestricted API key is unsafe because there is no built-in limit on what it can do. AgentWallet solves this by giving each agent its own identity and its own guardrails, so an agent can transact without ever holding unbounded authority.
The building blocks: accounts, principals, and agents
Every business signs up as a tenant account. Inside that account you create Principals, where a Principal represents a person or a budget, and each Principal owns one or more Agents. This hierarchy is what makes delegation safe: authority always flows downward and can only ever get narrower.
- Account — the business tenant and the top of the control hierarchy.
- Principal — a person or budget that owns agents and sets their envelope.
- Agent — the AI actor that actually spends or gets paid, always inside its Principal's limits.
Controls that cascade
Money controls cascade Account then Principal then Agent, and a child can only ever be more restrictive than its parent. That is a four-layer policy cascade: the account sets an outer boundary, each principal tightens it, and each agent tightens it further. No configuration mistake at a lower level can widen what a higher level allowed.
How an agent connects
Agents connect over the Model Context Protocol (MCP). An agent authenticates with a scoped Personal Access Key and can request a one-shot identity card through the agent.passport MCP tool, which tells it who it is, what it may do, and what limits apply. From there it can spend on issued cards, send payouts on approved rails, or shop online through a controlled browser.
Frequently asked questions
- Who holds the money in AgentWallet?
- The business account does. Agents never own funds outright; they are granted the ability to spend within limits, and a card purchase draws from that card's own bank-held balance while payout rails draw from the wallet.
- How does an agent prove its identity?
- It authenticates over MCP with a scoped Personal Access Key and can fetch a one-shot identity card via the agent.passport tool that states its permissions and limits.
- Can an agent exceed the limits I set?
- No. Over-limit actions are blocked outright, and over-policy actions create a human approval request instead of executing.
Sources
Give your agents a wallet
Per-agent wallets, virtual cards, USDC on Base, and policy guardrails — provisioned through one MCP endpoint.
Start free