Skip to main content
A Tythe Account is controlled by keys you hold. Tythe holds none of them. This page sets out every kind of key that touches your account, what it can and cannot do, and the rules for keeping control.

​
The keys

​
The owner

The wallet you connect at onboarding is the owner of your account. Owner authority is bounded by two account-level rules that no key can override: liened balance cannot be moved except by the loss waterfall on default, and balance reserved for live mandates cannot be withdrawn out from under them. Everything else is yours to move at any time. A single owner key is a single point of failure. Configure a recovery key in Settings after deployment.

​
Operators

Binding a wallet to your profile makes it an operator. In V1 every operator has the same signing authority; multi-operator threshold approval (for example, two of three operators to issue a mandate above a size) is on the roadmap. Binding requires two signatures: your existing operator submits, and the new wallet signs its consent as a typed message. A wallet can be bound to one principal at a time. Unbinding retains the history and cannot leave the profile with no live wallet.

​
External wallets

Wallets you fund from and withdraw to. They are bound to your profile so that withdrawals go only to addresses you have consented to. They have no authority on the account.

​
Agent keys

Each agent you bind holds its own key in its own runtime. Tythe never holds it. The key is registered on your account as a session signer whose scope is the agent’s mandate: with no live mandate, the key can do nothing. A leaked agent key can do exactly what the agent’s mandate allows, until you or the Intelligence Layer revoke it. For x402 payments the agent key signs payment intents inside a payment session it opened under its mandate; the account validates each intent against the session’s cap, nonce range, expiry, and allowlist before USDC will settle it.

​
Recovery

A recovery key can replace the owner key after a timelock you set. Designate it from Settings using the owner key. The timelock is the window in which a compromised recovery attempt can be cancelled by the owner. Tythe has no recovery role and cannot restore access.

​
Signing

Every signature you make on Tythe is a typed message that shows what is being signed: the instrument’s hash and template, or the action and its parameters. Never sign a message you cannot read. Hardware wallets are supported for operator keys.

​
Rules for keeping control

Use a hardware wallet for the owner. Use a separate operator wallet for day-to-day signing if you sign often. Never use an agent key as an operator.
Recovery is the only path back from a lost owner key. Set it up before the account holds meaningful balance.
An agent key’s blast radius is its mandate. Budgets, counterparty allowlists, expiry, and escalation thresholds are the controls. See Delegate.
Revocation is immediate, cascades to sub-agents, closes payment sessions, and is never blocked by a pause. If an agent key may be compromised, revoke it from the console, then investigate.
Actions above a mandate’s escalation threshold wait for an operator and fail if none approves. A quiet inbox is a control; an ignored one is a bottleneck.

​
What no key can do

  • Move liened balance outside the loss waterfall.
  • Withdraw balance reserved for a live mandate.
  • Widen an agent’s authority above the ceiling its mandate sets.
  • Act on your account from Tythe’s side. There is no Tythe key.

Instruments you sign

What each typed-message signature commits you to.

Treasury

Idle, reserved, and liened balance, and withdrawals.