# Custody

> Where the key lives, and what that bounds.

v1 uses a delegated session key: scoped, expiring, and held encrypted at rest. It is decrypted into memory for the duration of one signature and never appears in any tool result or log.

The strongest guarantee here is economic rather than procedural. The session key's funded balance is the true ceiling — a key holding $20 cannot spend $21 regardless of what the agent is convinced to do, even if the wallet process is fully compromised. Fund it accordingly.

Signing sits behind a three-member interface: an address, and the ability to sign a fully-formed EIP-712 payload. No domain construction and no policy logic live inside it, which is what makes a KMS or a Flare Confidential Compute enclave a swap rather than a rewrite.