> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Building with Envoy

> Routing page for partners building Envoy — the money agent that transacts on a user's behalf.

You're building flows where **<Tooltip headline="Envoy" tip="The money agent that acts on a user's behalf." cta="Glossary →" href="/glossary">Envoy</Tooltip>** — the money agent — takes actions on behalf of a user: searching, selecting, purchasing, inside a capability envelope the user pre-signed. Envoy executes <Tooltip headline="Errand" tip="An agent's scope-bound tasking run: Intent → Authorization → Vigilance." cta="Glossary →" href="/glossary">Errand</Tooltip>s against the user's <Tooltip headline="Stamped Mandate" tip="A signed authorisation a user grants for specific scoped actions — delivered on the wire as a PINT." cta="Glossary →" href="/glossary">Stamped Mandate</Tooltip>s. Your integration touches three Sumvin surfaces in sequence: **Errands** for orchestration, **Stamped Mandates (PINTs)** for authorisation, and **agent signers** for cryptographic identity.

<Snippet file="product-term-disambiguation.mdx" />

## How the pieces fit

* **Errands** are the orchestration layer. An Errand represents the agent's task and its state over time — Intent, Authorization, Vigilance.
* **Stamped Mandates (PINTs)** are the authorisation layer. The user signs the **first** Stamped Mandate — the mandate PINT — declaring the cap, duration, and the **scopes they delegate to Envoy** (e.g. `sr:us:pint:spend:execute`). Envoy re-uses a **subset** of those delegated scopes to mint the narrow, per-action PINTs it needs to carry out the mandate — and can never mint a scope the mandate didn't grant; the policy layer rejects any PINT outside the delegated envelope.
* **P-256 agent signers** are the identity layer. Each user has a per-user agent signer — the P-256 key Envoy uses to **sign those PINTs** on the user's behalf. An agent-signed PINT verifies as the user through the Safe's EIP-1271 path, so a merchant sees the same `X-Pint-Signature` / `X-Pint-Payload` it would for a user-signed PINT.

An action flows Errand → user-signed mandate PINT (delegating scopes) → Envoy-minted, narrow-scoped PINT (a subset of the mandate) signed by the agent signer → merchant verification of the PINT signature at checkout — including Envoy executing transactions without human interaction, across any rail (a P2P stable payment or a Visa Intelligent Commerce payment), entirely inside the pre-signed envelope.

## Start here

Read in this order:

1. **[Errand guide](/guides/ipa)** — the lifecycle of an Errand, end-to-end.
2. **[Scopes reference](/identity/scopes)** — the capability envelope, with `sr:us:pint:spend:execute` as the spend scope.
3. **[Agent signers](/identity/agent-signers)** — the per-user P-256 key Envoy uses to act.
4. **[Errand lifecycle](/products/errand/errand-lifecycle)** — the state machine diagram with every transition.

## Scope and tier for an agent-initiated action

The scope carried by a Stamped Mandate determines which verification tier applies at checkout. `sr:us:pint:spend:execute` is the only Enhanced-tier scope today, and it is the scope an agent-initiated purchase carries. Merchants accepting it must verify both the JWT and the underlying EIP-712 signature. See [verification tiers](/merchant/verification-tiers) for the full breakdown.

## Next up

Read the [Errand guide](/guides/ipa) for the orchestration layer, then the [scopes reference](/identity/scopes) to decide what Envoy may do, then [agent signers](/identity/agent-signers) for the cryptographic key that does the signing. [Verification tiers](/merchant/verification-tiers) is the merchant-side picture — the shape your Stamped Mandate meets at the checkout boundary. **Envoy isn't trusted because it's an agent. It's trusted because the envelope it acts inside was pre-signed by the user.**

## Related

* [Agentic commerce use case](/overview/use-cases/agentic-commerce)
* [Errand overview](/products/errand/overview)
* [Errands quickstart](/guides/quickstarts/perpetual-search)
* [Global x402 acceptance](/products/payment-links/global-x402-acceptance) — persistent, identity-keyed payment target Envoy can settle against
* [Payment request links](/products/payment-links/payment-request-links) — one-shot, agent-fulfillable payment primitive