Introduction

Warden — a local-first vault that hands agents revocable warrants, not your keys.

Warden is a local-first trust layer for AI agents with on-chain guardrails and human oversight. It keeps your wallets and secrets in a sealed vault on your own machine and never hands them to an agent. Instead, you issue the agent a warrant — a scoped, revocable capability bound to policy rules and approval gates, anchored on Sui.

The agent can act, but only within the warrant: routine actions pass through, high-risk ones wait for the owner wallet's sign-off, and you can revoke it at any time.

The problem

An agent with your keys is an agent with your money — at machine speed, with no second look, and on-chain no undo. A jailbroken or buggy agent holding a private key can drain an account; one holding a raw API token can run DELETE /production or exfiltrate the key itself. Prompts and system messages can't stop that — the guardrail has to live somewhere the agent can't reach.

How it works

Warden sits between the agent and everything it wants to touch:

  1. Vault — your wallets and secrets, sealed at rest, built on the Open Wallet Standard. See Vault.
  2. Warrant — the vault issues a scoped, revocable warrant; the agent holds only its bearer token, never a key.
  3. Surfaces — whatever the agent does runs through a policy-checked surface:
    • the gateway (warden-gateway) for web2 API calls — the agent makes normal requests and the real credential is injected at the edge, and
    • the signer (warden sign) for web3 transactions — the agent runs it directly with the token from its environment.
    • warden run launches an agent wired to both, scoped by one warrant.
  4. Sign-off — actions over a policy threshold are held for the owner's approval; within the threshold, they pass through.

The agent never sees a private key or a raw credential — the signer signs in-process and the gateway injects the real secret at the edge.

Backed by Sui

The trust isn't Warden's word — it's enforced on-chain (see On-chain):

  • Move — a registry of vaults and warrants; you register, revoke, and re-enable from your wallet.
  • Seal — seals the vault; revoking it makes the key servers refuse decryption — a real kill-switch.
  • Walrus — holds the policy blob and a tamper-evident audit trail.

Sign in as the owner with zkLogin — no new keys to manage.

Why local-first

Everything runs on your machine: the vault, the signer, and the gateway. Keys are decrypted only inside the signing path and never leave; the only things that go off-machine are the on-chain registry entries (public by design) and the Seal-encrypted policy and audit records on Walrus. No server holds your secrets, and the kill-switch is enforced by the network, not by trusting Warden.

Next steps