lessons from shipping a confirm flow.
AI agents are getting wallets. Alchemy ships session signers so an agent never touches the key, Tether's WDK powers self-custodial agent wallets, and on a recent Monad DevRel stream Alchemy's agent-wallet engineer said plainly that granular agent permissions are unsolved industry-wide. The two models everyone circles are the same: lock the agent down to a narrow workflow, or approve every step by hand. We have been shipping the second model in the open.
nad-agent: an open-source agent
wallet on Monad.
Local model (Tether QVAC), self-custodial smart account (Tether WDK), gasless sends.
Over three merged changes and one accepted proposal in nad-agent, a few lessons crystallized that we have not seen written down elsewhere.
A bare confirm? y/N teaches the human to type y. What changed
behavior was building a resolved preview before the question: the checksummed recipient the
transaction will actually use, the amount, the fee expectation for the current gas mode, the
balance before and after, and a simulated outcome. The human confirms a concrete effect, not
an intention.
To: 0x92936497B6ad2BA84b3f7Af22C9afF15f00b13B5
Amount: 0.01 MON
Gas: dry-run (simulated, nothing broadcast)
Balance: 0.5 -> 0.49 MON
confirm? [y/N]A recipient whose mixed-case checksum fails is provably wrong: refuse it before the prompt even renders, with a non-zero exit in scripted mode. A send the simulator says will revert, or an amount above the current balance, is probably wrong: surface it as a warning line inside the preview and let the human decide.
Collapsing these two classes into one is what makes wallets either unsafe (everything is a warning) or unusable (everything is a refusal). Agents retry around soft errors, so the hard class must be genuinely hard.
Per-action confirmation is the baseline, but not every context deserves equal friction. Switching the wallet to mainnet asks for one explicit typed acknowledgement per session, then stays out of the way. Escalate friction with stakes; do not tax every step equally, or the human stops reading.
Agents do not only run in interactive terminals. Piped and scripted runs need the same confirm flow: answers are consumed from the script in order, a missing answer cancels the action, and a cancelled or refused write exits non-zero so an orchestrating agent sees the failure instead of assuming success. A permission model that only exists in a TTY is a demo, not a model.
Per-step approval covers what the human can see; a declarative policy covers what the agent could do while nobody is looking. We have proposed the second half for nad-agent as a policy file the wallet enforces before the prompt: a per-send cap, a per-session budget, an address allowlist, each violation named explicitly.
Approval and lock-down compose: the policy bounds the blast radius, the preview makes each step inside those bounds legible.
None of this requires a custodial setup or a cloud. The whole flow runs against a local model and a self-custodial account, which is exactly why the guardrails have to live in the wallet code itself: there is no server to save you.
Feedback welcome, especially from teams shipping their own agent wallets.
Prooflines, August 2026.