Learn · updated 31 Oct 2026
Guardrails for agent wallets
Keep the agent away from the key and the money it does not need. Nevarn splits each customer into two accounts: the wallet that holds their money, and a working balance Nevarn may act on under a bounded, expiring permission. The customer chooses how much moves across, and that amount is the most at risk.
Two accounts, not one
A customer's wallet holds their money; a separate working balance is what Nevarn may act on. Whatever stays in the wallet is out of Nevarn's reach no matter what happens to the company.
Nevarn never holds the customer's key. Where it signs on the customer's behalf it uses a limited permission the customer's own account has been told to accept, held encrypted.
Bound what may be signed
Every permission is bounded four ways: the places it may act, the actions it may take, a ceiling per transaction with a rolling daily limit, and an expiry of at most ninety days.
Spend policies decode the call itself — the recipient and the amount — rather than trusting that a signature looks right.
Show the drift
Every movement is written as two matching entries, and balances are recomputed from the records each time they are shown. What the books say is displayed beside what the account holds on the blockchain, with the difference — never quietly corrected.
Questions people ask
Does Nevarn hold customers' private keys?
No. A customer's wallet stays theirs; Nevarn acts only on a separate working balance, under a limited permission the customer's own account has been told to accept. The permission is scoped to named venues and actions, capped per transaction and per day, and expires within ninety days. Revoking it destroys the material that could produce a signature.
Who can remove a permission?
Only the customer. Only the customer installs a permission and only the customer can remove it; once revoked, their account refuses Nevarn's signature regardless of what Nevarn's records say.
How does a customer stop Nevarn?
One action halts all signing on the account, effective on the next request — not a support ticket. Separately, only the customer can remove a permission, and once revoked their account refuses Nevarn's signature regardless of what Nevarn's records say.