Docs / Turnkey

Governing Turnkey agent wallets

Turnkey evaluates policy before a signature is produced, inside a TEE. Countersign compiles your policy into Turnkey CEL policies — the strictest enforcement point available: a denied spend never becomes a signed transaction at all.

Enforcement model: pre-sign policy

Two design choices make this rail airtight:

The agent is a non-root delegated user. Turnkey policies don't bind root users, so Countersign provisions the agent as a delegated signer — which is exactly what makes the cap and the deny actually enforceable.
Approvals are native. approvalThreshold compiles to two correctly-bounded allow policies: auto-allow up to the threshold, and a consensus policy for the band above it — a human co-approval enforced by Turnkey itself, not by a dashboard.

Policy field	Binds	Detail
`freeze`	native	Explicit deny-all policy (deny outranks allow); measured 432–694 ms
`perTxCap`	native	CEL value bound at signature time
`allowlist / denylist`	native	CEL counterparty conditions
`approvalThreshold`	native	Turnkey consensus — human co-sign inside the enclave flow
`venues`	native	Chain-bound signing policy
`dailyCap`	countersign-layer	Turnkey conditions are per-transaction and stateless; the rolling 24 h total is tracked and enforced fail-closed by the guard

native = the rail itself enforces it, even if Countersign is bypassed or offline. countersign-layer = enforced fail-closed by the pre-flight guard and honestly labeled as such. Live, per-tenant version: GET /enforcement.

Proven live on Ethereum Sepolia

The live spike provisions a sub-organization, a delegated agent user, and an EVM wallet; applies the compiled policy; then proves in-policy ALLOWED → over-cap DENIED → freeze → DENIED (explicit). Freeze confirmed in ~432–694 ms in the cross-vendor runs.

Honest scope: everything here is testnet-only — no mainnet, no custody, no PII. The hosted sandbox seeds a mock three-backend fleet so you can exercise policy, guard, freeze, and ledger end-to-end; the vendor enforcement described on this page was proven live on real testnet backends. Mainnet follows a third-party security audit.

Try it in 60 seconds — no account, no human

Self-serve key, an isolated sandbox tenant with a three-backend demo fleet, testnet only.

Get a free key → Watch the freeze GitHub