Security model

pouch is built around one honest question: what happens when things go wrong?

The pouch bounds the blast radius

The wallet is a fresh key, generated locally, funded with only what the agent may trade. Your main funds never touch it. Whatever fails (the model hallucinates, a scam slips through a tier, the machine is compromised), the worst case is the pouch's balance.

This is the same structure Robinhood chose for its own agentic trading (dedicated, isolated accounts), rebuilt self-custodially.

Policy runs before signatures

Guardrails are enforced in the server, before any transaction is signed:

1. Trust tier of the token must be enabled by policy
2. The trade's USD value must fit the per-trade limit for that tier
3. The rolling 24h USD budget must not be exceeded
4. Denylisted addresses are always refused
5. Off-hours stock trades warn, or block if policy.stocks.blockOffHoursTrades is set

A blocked trade never reaches the chain and costs nothing. The error message states exactly which rule blocked it, so the agent can adapt instead of retrying blindly.

The key is never exposed to the agent

There is no MCP tool that returns the private key. A prompt-injected agent can read the address, balances, and history, but it cannot exfiltrate the key. Withdrawals default to off: the send tool is disabled unless the owner enables policy.transfers, and even then every transfer passes an optional recipient allowlist, a per-transfer USD cap, and a rolling 24h transfer budget before signing. With transfers disabled, funds can only rotate between currencies inside the wallet and moving them out requires the key, which only you hold.

Key backup (pouch-rwa export-key) is a CLI command intended to be run by a human in a terminal.

What pouch does not protect against

Being honest about the boundaries:

• A compromised machine. The key lives on the machine running the server (chmod 600, but plaintext). If that machine is owned, the pouch is owned. Keep the pouch small.
• Perfect scam detection. Tiers make scams expensive, not impossible. See Trust tiers.
• Bad trades. The agent can still buy high and sell low inside its limits. Guardrails bound losses; they do not create alpha.
• Server-side enforcement. Guardrails live in this server's code, not on the blockchain. An on-chain "vault mode" (ERC-4337 smart account with session keys) is on the roadmap for larger balances.