What is an agentic wallet? Non-custodial wallet design for autonomous AI agents

‍

A human wallet asks "do you approve this?" every time. An agent has no one to ask. An agentic wallet answers a different question entirely: "is this allowed?" — and it has to know the answer without a person in the loop.

As AI agents start paying for APIs, hiring other agents, and settling machine-to-machine invoices, the wallets built for people stop fitting the job. Not because the cryptography changes — it doesn't — but because the entire interaction model does. This is what an agentic wallet actually is, and what makes its design different from a normal crypto wallet.

01 — Why a normal wallet doesn't fit an agent

‍

A consumer wallet is built around a human decision point. Every meaningful action — send funds, connect to a new app, approve a contract — surfaces a prompt and waits for a person to tap "confirm." That pause is the entire security model: a human, in the moment, deciding whether this specific action is a good idea.

An autonomous agent has no such moment. It may need to pay for a hundred API calls a minute, hire a specialist agent mid-task, or settle a machine-to-machine invoice the instant it is generated. If every one of those required a human to click "approve," the agent would not be autonomous — it would be a very elaborate way of asking a person to click a button. Something has to make the "is this okay?" decision at machine speed, without a person watching each transaction.

That single requirement — remove the human from the moment of approval, without removing control — is the entire problem an agentic wallet exists to solve.

02 — What makes a wallet "agentic"

‍

An agentic wallet is not a different cryptographic primitive. Under the hood it is still keys, signatures, and on-chain transactions. What changes is where the judgment lives.

• A human wallet puts judgment in the person, exercised at the moment of signing, through a prompt.
• An agentic wallet puts judgment in a policy, defined in advance by a human, and enforced automatically at the moment of signing.

The agent still initiates every request — read a balance, propose a payment, call an API that costs money. But between that request and a signed transaction sits a policy engine that checks the request against rules a human set ahead of time. Most requests clear instantly, because they fall inside the policy. The rest get blocked or escalated. The agent gets speed; the business keeps control — just exercised earlier, as a rule, instead of live, as a click.

03 — The core design elements

‍

Strip an agentic wallet down to its working parts, and four things do almost all of the work.

• Scoped permissions. The agent's wallet can do a defined set of things — read balances, prepare a transfer, sign within a category — and nothing outside that scope. A support agent's wallet and a payout agent's wallet should not share a permission set.
• Spending limits. Per-transaction and daily caps bound the damage of any single mistake, compromised prompt, or bug. A wallet with a $50 daily limit cannot lose more than $50 a day, no matter what the agent is told to do.
• Allowlisted counterparties. Where practical, funds can move only to destinations approved in advance, which closes off an entire category of attack — a manipulated agent simply cannot send funds somewhere new.
• Approval thresholds. Small, routine payments clear automatically. Anything above a defined size — or anything unusual — pauses for a human or a higher-privilege process to sign off.

None of these are exotic. They are the same controls a finance team already uses for corporate cards and expense limits, moved into code and enforced at the moment of signing rather than in a monthly review.

04 — Staying non-custodial

‍

The word "non-custodial" is doing real work in the title of this piece, and it is worth being precise about what it means for an agent wallet specifically.

Non-custodial means the business — not a third-party platform, and not the agent itself in an unrestricted sense — controls the keys that ultimately authorize spending. The agent operates a wallet; it does not own an unbounded one. A cleanly designed agentic wallet keeps three things separate:

• Who holds the keys — the business, via its own infrastructure, not a platform that could unilaterally move the funds.
• Who defines the policy — a human, setting limits and rules in advance.
• Who triggers requests — the agent, operating strictly inside that policy, with no path to a raw, unbounded private key.

The test for whether a system is genuinely non-custodial and safe is simple: can the agent, acting alone, ever move funds outside the policy someone else defined? If the answer is no, the design holds. If the answer is yes — if a clever prompt or a bug lets the agent sign anything it wants — the wallet is not agentic, it is just unsupervised.

<pull-quote>"A human wallet asks permission every time and trusts a person's judgment in the moment. An agentic wallet asks permission once — when the policy is written — and trusts the system to enforce it every time after."</pull-quote>

05 — Two architectures that make this real

‍

Two underlying technologies do the heavy lifting for agentic wallets today, and they are often combined.

• MPC (multi-party computation) — the private key is split into shares, so no single key ever exists in one place. Policy checks (limits, allowlists) sit in front of the signing process, and a transaction is only co-signed if it passes. This keeps the model chain-agnostic and off-chain in its logic.
• Smart-account wallets (account abstraction) — the wallet is a programmable on-chain contract rather than a plain keypair. Permissions, spending limits, and session keys scoped to a specific agent or task can be encoded directly into the account, and enforced by the blockchain itself.

The practical difference is where enforcement happens — off-chain in a policy engine (MPC) versus on-chain in the account's own logic (smart accounts). Many real deployments layer both: an on-chain smart account for hard limits and revocability, with an MPC-based signing flow underneath for key security.

06 — Revocability and audit: the parts people forget

‍

Two properties matter as much as the limits themselves, and both are easy to skip in a first design.

• Revocability. A policy is only as good as your ability to change it. If an agent is compromised, misbehaving, or simply retired, its wallet's permissions need to be revocable immediately — not on the agent's next restart, and not by waiting for a session to expire on its own.
• Auditability. Every action a wallet takes should produce a log: which agent, what request, what the policy decided, and the resulting transaction hash if one occurred. Without this, "the agent did something wrong" is a mystery instead of a five-minute investigation.

A wallet with tight limits but no audit trail and no kill switch is only half designed. The point of an agentic wallet is not just to bound what an agent can do — it is to make sure a human can always see what it did, and always shut it off.

07 — What this is not

‍

It is worth being clear about the boundary. An agentic wallet is not a way to give an AI agent open access to a company's treasury and hope a prompt keeps it in line. Prompts are not security controls — they are instructions a sufficiently unusual input can override. The actual security lives in the policy engine and the signing infrastructure, enforced independently of anything the agent's model decides to do or say. If the only thing standing between an agent and unlimited spending is "the instructions told it not to," that is not an agentic wallet — it is an unsecured one with extra steps.

08 — Where CPAY fits

‍

CPAY's wallet infrastructure is built around exactly this model: non-custodial wallets that can be scoped to an agent, with spending limits, allowlisted destinations, and approval thresholds enforced at signing — not suggested to the agent and hoped for. Permissions are revocable instantly, every action is logged, and the keys stay with the business throughout, whether the signer is a person or an autonomous process. It is the wallet layer agentic systems need, without asking a business to hand over custody to make it work.

09 — FAQ

‍

Is an agentic wallet a different kind of cryptocurrency wallet?
No — the cryptography is the same. What differs is the layer of policy and permissions sitting between the agent's request and the signature, which a normal consumer wallet does not have.

Can an agent ever hold an unrestricted private key?
It shouldn't. A properly designed agentic wallet scopes the agent to defined actions and limits, with the actual signing key protected by MPC or a smart-account contract the agent cannot bypass.

What happens if an agent is compromised?
Its spending limits and allowlists bound the damage, and its permissions should be revocable immediately, cutting off further activity without needing to touch the underlying key infrastructure.

Do different agents need different wallets?
Generally yes. A support agent, a payout agent, and a procurement agent should have separately scoped wallets or permission sets, so a problem with one does not expose the others.

How is this different from just using an API key with rate limits?
A rate limit controls frequency, not value or destination. An agentic wallet controls how much can move, to whom, and under what approval — a materially stronger boundary for anything that touches real funds.

Conclusion

‍

The wallets built for people assume a person is watching every transaction happen. Agents break that assumption by design — they act constantly, at machine speed, with no one available to click "approve." An agentic wallet answers that gap not by removing control, but by moving it earlier: from a human's judgment in the moment, to a policy a human wrote in advance and a system that enforces it every single time. Get that right, and an agent can transact freely within limits a business actually chose — which is the only kind of autonomy worth granting.