Warrants

Scoped, revocable capabilities you hand to agents instead of keys.

A warrant is a bearer capability that grants an agent a narrow slice of the vault — specific wallets and/or secrets, bound to a policy. Issue one with warden warrant issue; the token is printed once.

Modes

• token (→ warden1_…) — an offline bearer token; revoke by deleting the local warrant.
• token+onchain (→ warden2_…) — also registered on Sui. Warden RPC-checks revoked / expired before every sign, so the owner can flip a remote kill-switch from their wallet.

Scope

• --wallets — wallets the warrant may sign with (web3).
• --secrets — secrets it may use through the gateway (web2).
• --policy — the bound policy (required for signing).
• --expires-days — optional TTL.