Skip to main content
PPeribolos Docs
Open app

Operate

Security model

Peribolos minimizes agent authority, keeps owner powers in the browser wallet, and fails closed when durable state or chain proof is unavailable.

Trust boundary

Enforced on Arc

Recipient allowlist, action bitmap, caps, expiry, pause, signer authorization, balance, withdrawals, and treasury behavior.

Enforced by the hosted service

Workspace access, API-key scope, idempotency records, signer provider access, audit indexing, and offline preflight.

Hosted checks improve usability and reduce failed transactions, but the vault contract remains the final spending authority.

Credentials

  • Agent API keys are hashed at rest and scoped to one agent. Raw keys are returned once.
  • Circle Developer-Controlled Wallet credentials remain server-side; they are never delivered to the dashboard or model process.
  • Owner actions require a connected browser wallet whose address matches the contract owner.
  • Operator endpoints require an owner/admin user session or an operator-role API key.

Durable persistence

Production startup requires Supabase state storage. Every API JSON response waits for queued state snapshots to finish. If persistence cannot confirm the current snapshot, the API returns 503 PERSISTENCE_UNAVAILABLE instead of acknowledging a one-time key, payment record, or configuration change that may be lost.

Operational checklist

  1. Restrict CORS to the deployed dashboard origin.
  2. Store Circle, Supabase service-role, bootstrap, and signer-encryption values only in the host secret manager.
  3. Use a long unique bootstrap key once, then issue narrower agent keys.
  4. Monitor /ready; remove unhealthy instances from traffic.
  5. When revoking a live signer during an incident, also pause or rotate on-chain from the owner wallet.