Skip to main content
Your agent acts for you only in ways you have agreed to, and you can stop it at any time. These are the guarantees behind that.

​
The guarantees

1

A person verifies, once

Every Sigil starts with a real person verifying their identity. Agents inherit that proof; they never provide it.
2

A person signs every mandate

Your agent can ask for a Stamped Mandate. Only you can approve one, with your passkey, on a Sumvin page in your own browser. A connected agent’s access can’t be used to approve. This holds even if other people can message your agent, as with a shared OpenClaw: they can ask for a mandate, but they can’t approve one without your passkey.
3

Agents can't raise their own limits

An agent can’t approve its own mandate, widen one, or approve a purchase for itself. More authority always means a new mandate that you sign.
4

Least privilege

An agent gets only what you agreed to when you connected it. It can’t see your other agents, and a mandate caps what it can do, what on, and until when.
5

Revocable at any time

Revoke a mandate and everything relying on it stops, including errands using it. Disconnect an agent and that connection is no longer honoured; mandates it asked for stay valid until they expire or you revoke them. Neither needs the agent’s cooperation.
6

Auditable

You can see the mandates you have signed, every errand’s history, and where each one stands. Anyone your agent presents a mandate to can check that you signed it and that it still stands.
These guarantees are the connector’s. The CLI is different. The CLI is mainly for developers and people building and experimenting on Sumvin. The recommended way to use Sumvin is the MCP connector, or the API if you’re building (docs coming).The CLI runs on your own machine and signs with a key stored there. An agent running in your terminal can reach whatever you can reach, including approving Stamped Mandates the CLI signs for you. --yes skips the prompt that would have stopped to ask you. Approve things yourself, and never give an unattended agent --yes.

​
If something goes wrong

  • Your agent asks for something you didn’t expect. Decline it. Nothing is granted until you sign.
  • A mandate is broader than you want. Revoke it and sign a narrower one.
  • An agent is misbehaving, or you’ve stopped using it. Disconnect it, then revoke the mandates it asked for. Your other agents are unaffected.
  • A card purchase is wrong. Payments are coming soon. Card purchases follow Visa’s dispute processes. While payments are in preview, we handle each dispute ourselves, with care, especially if you think your agent got it wrong. Email hello@sumvin.com.
  • Anything else. Email hello@sumvin.com.

​
Next

Revoke and disconnect

Stop a mandate or an agent.

Privacy

What we hold, and who sees what.