Roles
| Role | Does | Signs with |
|---|---|---|
| Agent | Registers identity (name, type, capabilities) | Agent wallet |
| Controller | Grants scoped authority and limits | Controller account |
- Agent wallet — identifies the agent in NEUS and self-signs
agent-identity. - Controller account — signs
agent-delegation. It does not need to own the agent wallet.
Scoped authority
A delegation defines exactly what the agent may do:| Concept | Field | Notes |
|---|---|---|
| Allowed actions | allowedActions | Empty means permissive (unless denied) |
| Denied actions | deniedActions | Always wins over allowed |
| Scope | scope | Defaults to global; use payments:x402 for metered pay |
| Spend cap | maxSpend | Whole-number string in token base units (USDC: 6 decimals) |
| Expiry | expiresAt | Unix milliseconds; set when money or risk is in scope |
wallet, signing, spending, publishing, mcp, …) describe what an agent can do; delegation decides what it is allowed to do.
Setup state
| Field | Meaning |
|---|---|
linked | Identity and delegation both present |
principal | Signed-in account from your MCP session |
Next
Overview
Start here.
Delegation
Full field reference.
Flow
Setup order.
Cookbook
Recipes.