Skip to main content
xWell enforces permissions at two layers. Both must pass before any payment is signed.

Two layers of control

Signer-level (wallet policy)

Set when you create a wallet. These are constraints on the server signer itself — they apply to every agent sharing that wallet.
TemplateSigningTransactionsBest For
ConservativeMessage signing only (x402/MPP payments)No direct transactionsTesting, sandboxed agents
StandardPayment signing + limited transactionsCapped at 0.1 ETHMost use cases
Power UserFull signing accessUnlimitedProduction, high-volume
All templates deny private key export. These are hard constraints enforced by the TEE — they cannot be overridden at the agent level.

Agent-level (per-agent limits)

Set when you create or edit an agent. These are enforced by the xWell backend before the signing request reaches the TEE.
  • Daily spending cap — total the agent can spend per day (resets midnight UTC)
  • Per-transaction maximum — largest single payment allowed
  • Allowed chains — which chains this agent can use
  • Service access — blocklist or allowlist specific services
You can have multiple agents on one wallet, each with different limits.

What gets checked

Before every payment, the xWell backend checks the agent-level limits:
1

Chain allowed?

Is this chain enabled for this agent?
2

Per-transaction limit?

Does this payment exceed the agent’s per-tx maximum?
3

Daily cap?

Would this payment push the agent over its daily spending cap?
4

Service access?

Is this service blocked for this agent?
If all checks pass, the signing request goes to the TEE, where the signer-level policy is enforced independently.

Agent capabilities

After pairing, an agent can:
  • Make paid API requests (within limits)
  • Check its own identity, balance, and spending
  • View transaction history
  • Probe endpoints for payment requirements
  • Discover marketplace services
An agent cannot:
  • Access wallet private keys
  • Change its own policy or limits
  • Create or delete other agents
  • Modify signer authorization
  • Access builder-only endpoints

Monitoring

The dashboard shows real-time:
  • Per-agent daily spending
  • Transaction history with status
  • Failed payment attempts
  • Service health for frequently-used endpoints
You can rotate an agent’s API key at any time. The old key is immediately invalidated.