Open or create a vault
Both happen on the vault page, from your own wallet. Step by step, with pictures: Make your first vault.
- To create one, connect your wallet, choose a name and your limits, paste your agent’s public key (see Give your agent a key), and approve 6 test NEAR once. The NEAR stays in the vault to store its code.
- To open yours, connect your wallet: it lists the vaults you own. Anyone can open a vault by its name to read it.
Who holds which key
- The agent holds one key. It can ask for a payment or a token buy. It cannot approve, change a rule or start a withdrawal; it can only deliver a withdrawal the owner has already waited for, to the address the owner chose.
- The owner uses their own wallet, on another device than the agent, to approve what is held and to change the rules.
- The guardian is a second device, or someone the owner trusts. It can freeze the vault, cancel a waiting change and reject a held payment. It approves a large payment together with the owner, never alone. If the owner’s wallet is lost, it can start a recovery to a new owner; that waits, and the owner can cancel it.
- Svalin has no key to any vault. It publishes the grades the vault checks.
Setting up a vault deletes the key that deployed it, so from then on only the code decides.
Give your agent a key
The agent signs its requests with a key of its own. With Node 22 or newer, in the repository’s guard/examples/demo-agent folder:
node new-key.mjs ~/.svalin/my-agent.jsonPaste the public key it prints into the vault page. Give the agent the file and the vault’s name. The file holds the private key: never paste it anywhere. The vault page only takes the public one.
Any agent can hold the key, built on any model; Svalin runs no one’s agent. The key can only ask. Connect your agent shows the call it makes.
How a payment is decided
Every request ends in one of three answers, recorded on NEAR with a reason: paid, held for the owner, or refused. No model takes part.
| The request | The vault |
|---|---|
| A payee whose name reads like a well-known account or a past payee | Refused; one a letter away is held |
| A payee it has never paid | Checked in secure hardware first: refused if the account does not exist, held if it is under a day old or the check cannot run |
| Over a limit | Held |
| A price or payee that changed since the first payment | Held |
| A quote that has expired | Refused |
| The same item again within 15 minutes | Held |
| Three look-alikes or forged grades within an hour | The vault freezes itself |
Limits
A payee the vault has paid before gets the full per-payment limit; a new one gets a smaller limit. One daily limit covers both chains. With a guardian set, a held payment above the limits needs both the owner and the guardian.
Buying tokens
To buy a token, the agent brings its liquidity grade from the Svalin Index with a Merkle proof. The vault refuses a grade below the owner’s minimum or from an edition older than the owner allows (D and 2 days on the test vaults), then asks the Registry on NEAR to confirm the proof. A forged grade is refused and counts toward the freeze. The vault writes the swap itself, so the agent cannot route the money into another token.
The owner approves the market pools the vault may buy in, and the worst price accepted in each. Approving a pool waits, like any riskier change.
Each buy pays a fee set when the vault is made, 0.1% on the test vaults and 1% at most. Payments carry no fee.
Paying on Solana
The vault’s Solana address comes from NEAR Chain Signatures. Nobody holds its key, and NEAR’s signing network signs only when the vault asks. For a Solana x402 quote the vault runs the same limits and look-alike checks, then writes the payment itself.
What the owner can do
- Safer changes happen at once: lower a limit, freeze the vault, remove the agent.
- Riskier changes wait, 24 hours by default, and can be cancelled: raise a limit, add a payee, unfreeze, or take any money out. A stolen owner key cannot empty the vault in one go.
- A fingerprint on a phone can reject a payment or freeze the vault at any time. It can approve only a payment to someone the vault has already paid, within the limits, and it can never change a rule or take money out.
What it cannot do
- It runs on test networks only, so it holds test money.
- It cannot tell good data from bad, or see whether a seller delivered.
- Locked terms trust the first price a service asks, unless the owner locks them first.
- An agent that has been taken over can leave out what it is buying. Its payments still meet the limits and the look-alike checks, but not the locked terms.
- In a pool the owner approved, an agent that has been taken over can still trade at the owner’s worst price, within the limits.
- The exam vault on the Guard page runs an earlier version, made before approved pools.
- The check of new payees trusts OutLayer and Intel’s hardware, and it covers NEAR accounts, not Solana addresses.
- Payments on Solana trust NEAR’s signing network.
- There is no sanctions screening yet.
- A stolen owner key can still take the money once the wait is over if no one is watching, so set a guardian.