Wallet setups
Why everyday money, long-term savings and an agent's budget belong in separate wallets, and how to design the moves between them.
Three wallets keep risks apart better than one: an everyday wallet that apps can reach, a savings wallet they cannot, and a separate wallet for any software that spends on their behalf.
A wallet that connects to apps is busy. It receives requests all day: payments, signatures, data access. That is what makes it useful, and it is why it should not hold everything a person owns.
Three kinds of wallet
| Everyday wallet | Savings wallet | Agent wallet | |
|---|---|---|---|
| Purpose | Paying apps, shops and people | Holding larger amounts long-term | Letting software spend on the user's behalf |
| Connects to apps | Yes | No general app connection | Yes, within hard limits |
| Balance | What the user can afford to lose | The rest | A small, fixed budget |
| Typical protection | Phone or desktop wallet with permissions | Hardware device, multi-key setup or offline storage | Separate keys, limits enforced outside the agent |
| Top-ups | From savings, by a deliberate human action | n/a | From the everyday wallet, by a human |
Everyday wallet
This is the wallet people connect to apps, so it should hold only what the user could stand to lose. Say plainly that it is not meant for all of their savings, and show when the balance goes above the limit they chose.
Do
After the first money arrives, suggest a maximum balance, and offer to move anything above it to savings.
Recommendation
Ask "How much would you be comfortable losing if this phone were stolen?" when suggesting a limit, instead of offering a fixed amount.
Savings wallet
Larger amounts belong in a wallet that does not accept requests from apps at all. This could be:
- a hardware signing device
- a multi-key setup across devices or people (see Multi-key)
- a separate wallet kept offline
Money moves from savings to the everyday wallet, and only when a person moves it. Money moves from savings to the everyday wallet, and only when a person moves it.
Don't
Let the everyday wallet draw from savings on its own. A compromised app could then drain both.
Moving money between them
Design top-ups as an explicit transfer:
- The user opens the savings wallet, or confirms on their hardware device.
- They choose an amount for their everyday wallet.
- They confirm, on the hardware device if there is one.
The savings wallet never shares its keys or recovery material with the everyday wallet.
Agent wallet
AI agents and automated tools can pay for things on a person's behalf, such as API calls, data and services. That is convenient, and it carries a new kind of risk: an agent can misread instructions, be manipulated by a malicious page, or overspend in many small steps that each look harmless.
So an agent gets its own wallet, with its own keys, identity, funds and limits it cannot change, rather than a permission on the user's wallet. That means more than a separate compartment (a basket) in the user's main wallet. An allowance from the main wallet is the fallback, and it carries more risk.
Don't
Give an agent wallet access to savings, the owner's identity key or Passes, or the ability to reveal key linkage.
See Letting an agent spend for the limits and how its spending is reviewed.
Related
Written from: BRC-151 §2 and §9, BRC-100.
Checklist
The rules on this page, in a form you can work through.
4 rules