Give agents typed tools, not keys

The safest key is the one the agent never sees. Instead of handing an agent a private key and a library, give it a few typed tools that describe intent, and keep signing on the other side of a boundary you control.

Tarmac's tool contract

getContext()   → instruction, wallet, tokens, policy limits
getBalances()  → wallet balances (base units)
getQuote({ tokenIn, tokenOut, amountIn })
requestSwap({ quoteId, tokenIn, tokenOut, amountIn, minAmountOut?, reason? })
finish({ outcome, summary? })

The bundled demo agent and your own agent use exactly these tools, through the same gateway. That means the demo exercises the real product path, not a mock.

Scoped credentials

An external agent gets a run credential that works for one run only and is stored hashed. It travels in the URL fragment when you open a run in the browser, so it never reaches server logs. Runs are private until you choose to share a sanitized, read-only snapshot.

Signing only where it's safe

In fork mode the signing transport accepts only the loopback Anvil port spawned for that run, and refuses the upstream RPC outright. The upstream transport rejects every signing and state-changing method. A misconfiguration fails the run before anything is sent.