> ## Documentation Index > Fetch the complete documentation index at: https://docs.tythe.finance/llms.txt > Use this file to discover all available pages before exploring further. # Operations & Keys > The keys that control a Tythe Account: the owner, operators, external wallets, agent keys, and recovery. What each can do, what none of them can do, and how to keep them safe. A Tythe Account is controlled by keys you hold. Tythe holds none of them. This page sets out every kind of key that touches your account, what it can and cannot do, and the rules for keeping control. ### The keys | Key | Held by | What it can do | What it cannot do | | --------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | Owner | You (the first operator wallet at onboarding) | Everything an owner can: withdraw idle balance, sign instruments and mandates, bind and unbind wallets and agents, approve escalations, migrate the account | Move liened balance; reduce idle below what live mandates have reserved | | Operator | Any wallet you bind to your profile | In V1, the same as the owner for signing: instruments, mandates, escalations, bindings | Nothing the owner cannot; threshold rules across operators are on the roadmap | | External wallet | You | Fund the account; receive withdrawals | Act on the account; sign for it | | Agent key | Your agent's runtime, never Tythe | Submit actions checked against the agent's mandate; sign x402 payment intents inside a session; co-sign its own Agent Authorization and sub-delegations | Anything outside its live mandate's effective scope; anything after revocation | | Recovery key | A key you designate | Replace the owner key after a timelock | Act on the account directly | | Tythe | No key | Nothing on your account. Tythe's role is the code installed on it: the mandate check and the hook | Move your funds, sign for you, or block your withdrawal of idle balance | ### The owner The wallet you connect at onboarding is the owner of your account. Owner authority is bounded by two account-level rules that no key can override: liened balance cannot be moved except by the loss waterfall on default, and balance reserved for live mandates cannot be withdrawn out from under them. Everything else is yours to move at any time. A single owner key is a single point of failure. Configure a recovery key in Settings after deployment. ### Operators Binding a wallet to your profile makes it an operator. In V1 every operator has the same signing authority; multi-operator threshold approval (for example, two of three operators to issue a mandate above a size) is on the [roadmap](/get-started/resources/roadmap-overview). Binding requires two signatures: your existing operator submits, and the new wallet signs its consent as a typed message. A wallet can be bound to one principal at a time. Unbinding retains the history and cannot leave the profile with no live wallet. ### External wallets Wallets you fund from and withdraw to. They are bound to your profile so that withdrawals go only to addresses you have consented to. They have no authority on the account. ### Agent keys Each agent you bind holds its own key in its own runtime. Tythe never holds it. The key is registered on your account as a session signer whose scope is the agent's mandate: with no live mandate, the key can do nothing. A leaked agent key can do exactly what the agent's mandate allows, until you or the Intelligence Layer revoke it. For x402 payments the agent key signs payment intents inside a payment session it opened under its mandate; the account validates each intent against the session's cap, nonce range, expiry, and allowlist before USDC will settle it. ### Recovery A recovery key can replace the owner key after a timelock you set. Designate it from Settings using the owner key. The timelock is the window in which a compromised recovery attempt can be cancelled by the owner. Tythe has no recovery role and cannot restore access. ### Signing Every signature you make on Tythe is a typed message that shows what is being signed: the instrument's hash and template, or the action and its parameters. Never sign a message you cannot read. Hardware wallets are supported for operator keys. ### Rules for keeping control Use a hardware wallet for the owner. Use a separate operator wallet for day-to-day signing if you sign often. Never use an agent key as an operator. Recovery is the only path back from a lost owner key. Set it up before the account holds meaningful balance. An agent key's blast radius is its mandate. Budgets, counterparty allowlists, expiry, and escalation thresholds are the controls. See [Delegate](/principals/account/delegate). Revocation is immediate, cascades to sub-agents, closes payment sessions, and is never blocked by a pause. If an agent key may be compromised, revoke it from the console, then investigate. Actions above a mandate's escalation threshold wait for an operator and fail if none approves. A quiet inbox is a control; an ignored one is a bottleneck. ### What no key can do * Move liened balance outside the loss waterfall. * Withdraw balance reserved for a live mandate. * Widen an agent's authority above the ceiling its mandate sets. * Act on your account from Tythe's side. There is no Tythe key. What each typed-message signature commits you to. Idle, reserved, and liened balance, and withdrawals.