> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust and safety

> The guarantees Sumvin makes when your agent acts for you, and what happens if something goes wrong.

Your agent acts for you only in ways you have agreed to, and you can stop it at any time. These are the guarantees behind that.

## The guarantees

<Steps>
  <Step title="A person verifies, once">
    Every [Sigil](/concepts/sigil) starts with a real person verifying their identity. Agents inherit that proof; they never provide it.
  </Step>

  <Step title="A person signs every mandate">
    Your agent can ask for a [Stamped Mandate](/concepts/stamped-mandates). Only you can approve one, with your passkey, on a Sumvin page in your own browser. A connected agent's access can't be used to approve. This holds even if other people can message your agent, as with a shared OpenClaw: they can ask for a mandate, but they can't approve one without your passkey.
  </Step>

  <Step title="Agents can't raise their own limits">
    An agent can't approve its own mandate, widen one, or approve a purchase for itself. More authority always means a new mandate that you sign.
  </Step>

  <Step title="Least privilege">
    An agent gets only what you agreed to when you connected it. It can't see your other agents, and a mandate caps what it can do, what on, and until when.
  </Step>

  <Step title="Revocable at any time">
    Revoke a mandate and everything relying on it stops, including errands using it. Disconnect an agent and that connection is no longer honoured; mandates it asked for stay valid until they expire or you revoke them. Neither needs the agent's cooperation.
  </Step>

  <Step title="Auditable">
    You can see the mandates you have signed, every errand's history, and where each one stands. Anyone your agent presents a mandate to can check that you signed it and that it still stands.
  </Step>
</Steps>

<Warning>
  **These guarantees are the connector's. The CLI is different.** The CLI is mainly for developers and people building and experimenting on Sumvin. The recommended way to use Sumvin is the [MCP connector](/get-started/connect), or the API if you're building (docs coming).

  The CLI runs on your own machine and signs with a key stored there. An agent running in your terminal can reach whatever you can reach, including approving Stamped Mandates the CLI signs for you. `--yes` skips the prompt that would have stopped to ask you. Approve things yourself, and never give an unattended agent `--yes`.
</Warning>

## If something goes wrong

* **Your agent asks for something you didn't expect.** Decline it. Nothing is granted until you sign.
* **A mandate is broader than you want.** Revoke it and sign a narrower one.
* **An agent is misbehaving, or you've stopped using it.** Disconnect it, then revoke the mandates it asked for. Your other agents are unaffected.
* **A card purchase is wrong.** Payments are [coming soon](/reference/status-labels). Card purchases follow Visa's dispute processes. While payments are in preview, we handle each dispute ourselves, with care, especially if you think your agent got it wrong. Email [hello@sumvin.com](mailto:hello@sumvin.com).
* **Anything else.** Email [hello@sumvin.com](mailto:hello@sumvin.com).

## Next

<Columns cols={2}>
  <Card title="Revoke and disconnect" icon="unplug" href="/guides/revoke">
    Stop a mandate or an agent.
  </Card>

  <Card title="Privacy" icon="lock" href="/concepts/privacy">
    What we hold, and who sees what.
  </Card>
</Columns>