> ## Documentation Index
> Fetch the complete documentation index at: https://docs.0xkey.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent-restricted signing

> Give automation agents narrow signing power with deny-by-default policies.

Agents and bots should never hold broad signing rights. Company Wallets let you issue an API-only user, tag it `agent`, and allow only the exact actions you intend.

## Pattern

1. Create an API-only user + tag `agent`
2. **Deny** broad `signRawPayload` for that tag
3. **Allow** a specific contract selector / recipient / chain
4. Optional consensus for first-seen contracts
5. Meter usage via billing / webhooks; revoke by deleting the API key

## Controls

* Prefer contract allowlists over “sign anything”
* Keep agent keys out of root quorum
* Use short-lived keys and rotate on incident

## Related

* [Policy templates](/company-wallets/policy-templates)
* [Delegated access](/concepts/policies/delegated-access-backend) — when the wallet is user-owned instead of company-owned