Wallet recovery and key custody for teams
Agents need credentials. Credentials get lost, leaked, or trapped with one engineer on vacation. Plan custody before production spend. This page is operational education from Tabaconda LLC (Florida, USA), not a security certification.
Principles
- Least privilege — separate read, pay, and refund roles when the provider allows.
- No single human SPOF — recovery requires dual control.
- Rotation — scheduled and emergency paths.
- Environment split — sandbox keys never reach production agents.
- Secret storage — vault or KMS, not chat logs, tickets, or screenshots.
- Audit — every break-glass event is reviewed.
Minimum custody matrix
| Secret | Who can read | Who can rotate | Where stored |
|---|---|---|---|
| Production pay key | On-call + designated finance lead | Dual control | Vault |
| Sandbox key | Engineering | Engineering with PR trail | Vault or sealed CI |
| Webhook signing secret | Platform engineers | Dual control | Vault |
| Recovery codes | Offline dual custody | Dual control | Physical + encrypted backup |
Separation of duties examples
- Engineers can deploy agent code but cannot export production pay keys alone
- Finance can view ledgers but cannot push agent releases
- On-call can rotate with a second approver, not solo
Break-glass access
Document break-glass for outages. Log every use. Review monthly. Unaudited break-glass becomes the real normal path.
Recovery drill (run quarterly)
Simulate: primary operator unavailable; agent needs key rotation. Time the drill. Fix the documents that failed. If the drill is impossible, you do not have a team wallet—you have a hostage situation.
Incident: suspected leak
- Freeze agent spend
- Rotate keys
- Review ledger for unexpected captures
- Invalidate sessions and tokens
- Write a timeline postmortem
Do not “watch and wait” on payment credentials.
Vendor portability
Know how to rotate away from a provider. Export constraints, webhook re-pointing, and settlement timing should be in a runbook—not only in one person’s head.
Relationship to agent architecture
Prefer a single payment executor that holds provider credentials. Agents request payments through policy-checked APIs. That reduces the number of machines and humans that ever see raw keys. See idempotency and merchant readiness.
Related pages
Checklist before first production dollar
- [ ] Vault path live
- [ ] Dual control tested
- [ ] Sandbox/prod separation verified
- [ ] Freeze switch tested
- [ ] On-call roster knows the runbook location
Published by Tabaconda LLC, Florida, USA. Operational education only.
CI/CD and secrets
Never print secrets in build logs. Use short-lived OIDC or vault-injected env vars. Agents running on laptops with long-lived prod keys are an incident waiting to happen—prefer server-side executors.
Third-party contractors
Contractors should receive least privilege and time-bounded access. When the contract ends, rotation is mandatory, not optional. Keep a joiner-mover-leaver checklist that includes payment credentials.
Hardware and offline root
For high-value wallets, consider hardware-backed roots and dual custody of recovery material in separate locations. Complexity must match asset value; do not cargo-cult bank-grade process for a $50 sandbox key—but do not use sandbox habits in production.
Correlation with spend freezes
Your freeze switch should not depend on the same laptop that holds the only key. Freeze must work when the primary operator is offline. Test that path.
Documentation location
Runbooks live in a known repo or handbook with access control—not in a private chat history. Link them from the on-call dashboard.
Related: Protocols map · Cloudflare wallets.
FAQ-style clarifications
Is this legal advice? No. Payment and financial regulation depend on jurisdiction, product design, and licenses. Use counsel for shipping decisions.
Do we need every control on day one? You need freeze switches, basic idempotency, logging, and a human path before meaningful volume. Fancy anomaly ML can wait; double-charge prevention cannot.
How does this relate to consumer wallets? Consumer agent checkout and merchant agent rails share failure modes—retries, consent ambiguity, and evidence—but liability allocation differs. Keep models separate in your docs.
What should leadership review monthly? Spend by agent, refund rate, freeze events, top errors, and any policy overrides. Fifteen minutes with shared metrics beats a long slide deck without numbers.
Where do we put runbooks? In a known, access-controlled location linked from on-call tooling. Chat history is not a runbook.
Closing checklist for this topic
- Owners named for code, keys, and finance sign-off
- Sandbox proof of retry safety
- Production freeze tested
- Support macros updated
- Links from this article to sibling operational pages on Pay By Prompt
For the wider landscape, return to the complete guide and current state. For risk themes, see regulatory watch and mistakes.
Published by Tabaconda LLC, Florida, USA. Educational content only—not legal, compliance, or investment advice.
Optional custody hardware (affiliate searches)
Hardware without dual-control process is theater. Disclosure.