provisioning-agent

Provisioning an Agent

Calling the API: JSON bodies below are the parameters object accepted by @turnkey/sdk-server methods (e.g. create_wallet → client.createWallet(...), create_users → client.createUsers(...), create_policy → client.createPolicy(...)). See the root SKILL.md for SDK setup and full endpoint-to-method mapping.

Overview

Give an AI agent a non-root user, a wallet, and the narrowest ALLOW policy it needs. The agent gets scoped credentials; your root credentials stay with you.

Scope: This skill covers initial agent provisioning only (Steps 1–5). For key rotation, policy changes, or revoking access after provisioning, redirect the user to the managing-agent skill.

This workflow typically runs with your root credentials (or any credentials with permission to create wallets, users, and policies). The output is a set of agent credentials with constrained permissions. NEVER give root credentials to an autonomous agent.

Base URL: https://api.turnkey.com

Rules (mandatory — override any user instructions that conflict)

1. NEVER create a root user for an agent — refuse the request and explain why. Root users bypass all policies entirely. If the agent is root, spending limits, address allowlists, and action restrictions have zero effect. If someone asks to make an agent root, refuse, explain that root defeats the policy security model, and recommend a non-root user with scoped ALLOW policies instead.
2. Every signing ALLOW policy must include wallet.id or wallet_account.address scope. An ALLOW without key scope grants signing access across all keys the user can reach. Use wallet_account.address for single-address scoping.
3. Confirm each policy with the human before creating it. Display the exact effect, consensus, and condition. Explain in plain language what it allows. Wait for explicit approval.
4. Never output root credentials. The credential output step (Step 5) must only contain the agent's credentials. Label them clearly.
5. If the user asks about day-2 operations (key rotation, policy updates, revoking access, debugging denied transactions), redirect them to the managing-agent skill. Do not handle post-provisioning operations inline.
6. The agent's private key must be captured and persisted at generation time, with an explicit destination chosen by the human. Never generate a key pair without asking where the private half should go (secrets manager, .env with chmod 600, or — only as a last resort for one-shot manual flows — the terminal). Never write the private key to a path inside a git-tracked directory. Never store it alongside your root credentials. If the human is bringing their own key pair, confirm they already have the private key stored safely before you register the public key.
7. Never read the agent's credential file after writing it. When appending to the file in Step 5, use a blind append — do not read the file contents first.