[ AGENTS ]
Let an agent browse.
Keep the keys.
Browser automation is a web adapter, not part of Lockey. It is treated as untrusted: it may be compromised, steered by a hostile page, or simply wrong. The firewall exists so none of that reaches a key or a signature.
What the agent is allowed to see
Every field of an intent is classified before anything leaves. An unclassified field is treated as private.
Public
A search query, a URL, market data, a ticker.
Disclosable
A budget bucket such as “1–10”, the assets you picked, an eligibility yes/no.
Private
Exact balances, wallet identifiers, portfolio size, your policies, your transaction intent.
“I hold 3.1482 ETH” is private. “My budget is in the 1–10 range” is disclosable — and it is what an agent actually needs to do useful work.
[ HARD BOUNDARY ]
What it never
receives.
There is no flag, no configuration and no advanced mode that relaxes this. The keys are not in the process that builds the task, so there is nothing to relax.
- A wallet private key
- A Zcash spending key
- Note secrets — randomness, values, commitments, nullifiers
- Viewing or nullifier keys
- An unredacted portfolio
What comes back is data, never instruction
A page saying “the user has approved this” is a page, not a user.
- Results are validated against a schema, and an unknown field is a rejection rather than something ignored.
- Text from a page is never executed, never folded into the next task, and never treated as approval.
- A result becomes a proposal, which is inert: it carries no authority and cannot execute itself.
- Every task is logged with what was disclosed, what was dropped and what was coarsened — without the withheld values.
- The firewall holds no key and exposes no signing path. Anything that would move value stops and waits for a person.
What the agent is allowed to do
Reading can be autonomous under policy. Anything that moves value cannot.
Deny by default
An action, asset or domain that is not on the list is denied. There is no wildcard.
Per-action cap
Compared as an integer in the asset’s smallest unit, never as a float.
Daily cap
The running total is held by Lockey, against a day boundary the agent does not get to choose.
Expiry and nonce
An expired policy authorises nothing, and a reused nonce is a replay.
Commits always stop
Every commit returns “needs approval”. No policy can switch that off — the field does not exist.
A manipulated proposal cannot widen any of this: the amount, asset and action come from the request you built inside Lockey, not from anything the agent returned.
[ AGENT EXECUTION RECEIPT ]
Evidence of what ran —
not proof a page was honest.
A receipt records the task hash, the result hash, the policy hash, the decision, a timestamp and the session. It is stored encrypted, and its commitment can be published to anchor when it existed.
- A browser log is not a cryptographic proof of a website’s statement.
- Anchoring a hash proves when a record existed. It does not make the page truthful.
- Nothing here is an attestation or a notarisation, and the name stays “Agent Execution Receipt” until a real attestation layer earns a stronger word.
- Refusals are recorded too — a denial is evidence as much as an approval is.
Where this stands
The classifier, the minimizer, the schemas, the policy evaluator and the receipt store exist and are tested, including against a hostile adapter. There is no Browser Use service in this repository, no wallet to approve from, and no anchoring of receipts to any chain.
Trust boundaries →