Deploying a Policy

Configuring your own wallet by hand, as this guide describes, is the manual version of what stellar agentgate init automates end-to-end against the canonical agent-policy instance — no policy deployment of your own required.

Configuring an allow-list

agent-policy.configure sets a wallet’s allow-list and spend cap in one call, authenticated by the wallet itself (so only the wallet owner can change it):

await invokeAsWallet({
  server, networkPassphrase, feeSource: owner,
  operation: policyContract.call(
    "configure",
    nativeToScVal(walletId, { type: "address" }),
    xdr.ScVal.scvVec([
      allowedCallEntry(vaultId, "deposit", null),      // uncapped
      allowedCallEntry(vaultId, "withdraw", 1),        // capped, amount is arg index 1
    ]),
    nativeToScVal(1000n, { type: "i128" }),             // window_allowance
  ),
  walletContractId: walletId,
  walletSigner: owner,
});

configure replaces the ENTIRE allow-list and cap in one call — it is not additive. Re-configuring with a shorter list removes methods that were previously allowed.

Restricting the agent’s signer

A signer must be added with SignerLimits scoped to the target contract, requiring the policy as a co-signer — see Security Model for why an unlimited signer defeats the whole design:

const restrictedLimits = signerLimitsScopedTo(vaultId, [signerKeyPolicy(policyId)]);
await invokeAsWallet({
  server, networkPassphrase, feeSource: owner,
  operation: walletContract.call("update_signer", signerDescriptorEd25519(agentPubkey, restrictedLimits)),
  walletContractId: walletId,
  walletSigner: owner,
});

Resetting to a pristine demo state

scripts/reset-demo.ts deploys an entirely fresh vault, policy, and wallet — new keys, zero prior spend, zero prior balance — and writes the result to .env:

bun run reset-demo

Useful before recording a demo or re-running the scripted walkthrough, since the spend cap is cumulative across a 24-hour window and doesn’t reset itself mid-demo.

See the full setup scripts

setup-wallet.ts, restrict-agent-signer.ts, and reconfigure-policy.ts cover the individual steps this guide describes, for when you don’t want a full fresh redeploy.

Get Started

Core Concepts

Guides

Configuring an allow-list

Restricting the agent’s signer

Resetting to a pristine demo state

See the full setup scripts

​Configuring an allow-list

​Restricting the agent’s signer

​Resetting to a pristine demo state

See the full setup scripts

Configuring an allow-list

Restricting the agent’s signer

Resetting to a pristine demo state