Devcon Archive logo
Devcon Devconnect Forum Blog
  • Watch
  • Event
    Event: background logo
    • Devcon 7
    • Devcon 6
    • Devcon 5
    • Devcon 4
    • Devcon 3
    • Devcon 2
    • Devcon 1
    • Devcon 0
    • Devconnect ARG
  • Categories
    Categories: background logo
    • Cryptoeconomics
    • Devcon
    • Developer Experience
    • Coordination
    • Core Protocol
    • Layer 2s
    • Real World Ethereum
    • Cypherpunk & Privacy
    • Security
    • Applied Cryptography
    • Usability
  • Playlists

Suggested

Loading results..

View all

About Devcon —

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.

An intensive introduction for new Ethereum explorers, a global family reunion for those already a part of our ecosystem, and a source of energy and creativity for all.

  • Watch
  • Devcon
  • Devconnect
  • Forum
  • Blog

Get in touch

devcon@ethereum.org

Subscribe to our newsletter

Crafted with passion ❤️ at the Ethereum Foundation

© 2026 — Ethereum Foundation. All Rights Reserved.

devcon8 / permission not possession setting agent wallet defaults before they harden

  • YouTube
Permission, Not Possession: Setting Agent Wallet Defaults Before They Harden preview
  • Details

Permission, Not Possession: Setting Agent Wallet Defaults Before They Harden

Duration: NaN:NaN:NaN

Speaker: Francesco Andreoli

Type: Lightning Talk

Expertise: Some familiarity with the topic

Event: Devcon

Date: Nov 2026

The setup: a friend's Telegram channel flags on-chain deployment events on a perps venue; I wired those signals to an agent that executes from my own wallet. Open-source, personal GitHub, open standards. The trap: approve every trade and the timing edge dies; never ask and the agent holds unbounded power — and prompt injection means I must assume it can be turned against me. The industry's fix is a custodian: the decade-old trade we came here to refuse, back through a side door. Instead: scoped delegation (ERC-7715/7710, session keys) — spend caps, time bounds, an allowlist, one-tap revoke. A company card with a limit, never the vault key. Six months of dry-run journals show where the caps would have saved me, where latency genuinely fights safety, and why ~a dozen events is a narrative, not statistics — so it's still not fully live. The stakes: agent wallet defaults are being set now, and they harden. Permission-not-possession must become the default grant, not the expert path.

Categories

DecentralizationWalletsKey ManagementCoordinationSovereignty