Agents & Keys

An agent is a machine actor authorised to request Casper x402 payments, CSPR.trade swaps, and deploy intents through AgentOps policy. Each one gets its own key and its own limits.

Create an agent

On the Agents screen, create an agent with a name you will recognise in the decision log. You get back:

• Agent id — agt_..., used in every authorize call.
• Agent key — ag_..., the credential the agent process authenticates with.

Give it a budget and a policy

A fresh agent has no room to spend. Assign it a budget from Casper Float and, if it should be tighter than the org ceiling, its own guard policy. An agent with no policy configured cannot be used for guard actions.

Its on-chain identity

Creating an agent also mints it a Casper keypair inside the key vault — its delegated key. That is separate from the ag_ API key above: the ag_ key gets the agent through AgentOps’ front door, the delegated key is what actually signs on-chain once you activate it with your master wallet. See Delegated Keys.

Agent status

• Active — may request authorizations within its policy.
• Suspended — key still exists, but every request is denied. Use this to pause an agent without tearing down its config.

Revoking an agent

Revocation is the emergency stop for one agent. It suspends the agent, aborts its in-flight decisions that have not yet committed, and reports which ones had already committed — because those are already signed and cannot be recalled.

The response tells you exactly what happened: the aborted decision ids and the committed decision ids. Check the committed list; that is the real-world exposure from the incident.

That is the proxy-side stop. If the agent’s delegated key is live on-chain, also run the master-signed on-chain revoke so the network itself stops accepting the key — see Delegated Keys.

Key hygiene

• One key per agent process. Do not share a key across agents.
• Never ship an ag_ key into a browser or a client-side bundle.
• Never give an agent an operator (sk_) key — it would then be able to widen its own policy.
• Rotating a key does not invalidate past decisions; they stay recorded and anchored.

Operators

Humans are managed separately, under Operators. Operators administer signer access, policy controls, audit exports, and agent keys for the organisation. Invite teammates there rather than sharing a login.