Agent Treasury

Session Vault

Bounded agent spending authority on Casper. The package owner deposits CSPR and grants an agent key a spend cap, rolling window, action bitmask, and absolute expiry — without sharing the owner key.

Who owns a Vault package?

Ownership is set once, at install time. When a wallet deploys (installs) the Vault package, init stores that wallet as owner. There is no separate claim step.

Role	How you get it	What you can do
Owner	Wallet that signed the Vault install	authorize_agent, revoke_agent, withdraw
Agent	Owner calls authorize_agent for that public key	agent_transfer under cap / window / expiry
Anyone	Any funded testnet wallet	deposit (payable), read get_owner / get_policy / vault_balance

Connecting to casperagent.xyz does not grant ownership. Using the shared public package hash only works for owner-gated calls if your connected wallet is the installer of that package. Otherwise install your own Vault from the Session Vault tab (up to ~500 CSPR payment), then use that package.

Why session keys

Autonomous agents need to sign transactions. Handing them a funded owner key is unsafe. Session Vault keeps the treasury in a contract and only allows authorized agent accounts to spend within explicit policy limits.

Policy model

Field	Meaning
spend_cap	Maximum motes the agent may spend in the current window
period_ms	Length of the rolling spend window in milliseconds
allowed_actions	Bitmask — bit 0 enables native transfer
expires_at	Absolute block time; sessions fail closed after this
active	False after revoke (mapping has no delete)

Entry points

Entry point	Caller	Purpose
deposit	Anyone (payable)	Fund the vault balance (CSPR attached)
withdraw	Owner	Withdraw unused CSPR
authorize_agent	Owner	Grant or replace agent policy
revoke_agent	Owner	Idempotent panic-button revoke
agent_transfer	Authorized agent	Spend under policy checks
get_policy / vault_balance / get_owner	Anyone	Read state

One-wallet demo path (any tester)

You do not need a second key. On the dashboard Session Vault tab:

Step	Action
1	Connect Casper Wallet on casper-test (fund via faucet)
2	If authorize fails with Not owner: Deploy / Install Vault from this wallet, then use that package hash
3	Authorize agent — agent defaults to your connected public key
4	Deposit a small CSPR amount (payable proxy; keep ~100 CSPR free for payment)
5	Agent spend — same wallet signs as the authorized agent
6	Revoke agent last (panic button)

Order matters: authorize → deposit → agent spend → revoke. Spending after revoke fails closed. Empty vault balance fails agent spend until deposit lands.

Shared MVP package vs your own install

The repo publishes a sample Vault package hash for verification on testnet.cspr.live. Owner-only calls on that package succeed only for the installer account. For a full interactive demo with your own wallet, install a Vault from the Session Vault tab. Install payment is up to 500 CSPR. Escrow and Attestation remain the shared settlement path for Marketplace and RWA without per-user installs.