Skip to main content
Steward is an open-source, self-hostable governed credential proxy and policy and approval layer for agent provider actions and wallets. It ships scoped grants, exact-request approval, policy-bound execution authorization on the primary EVM sign path, and signed audit evidence verifiable offline. Steward runs in your infrastructure. Configured provider calls can receive credentials at the proxy without returning those credentials to the supported agent caller. Governed wallet routes evaluate policy and approval before signing. The primary EVM transaction sign path adds a signed, short-lived, payload-bound, single-use authorization immediately before raw signing. Steward also maintains a tenant-scoped HMAC audit chain and exports Ed25519-signed evidence bundles. Verify a bundle offline with scripts/verify-evidence-bundle.mjs <bundle.json>. The script checks the signature against the public key carried in the bundle. Separately compare that key with an out-of-band trusted Steward signing key or fingerprint. Optional RFC 3161 anchoring can add an auditor-verifiable third-party time bound. Verification detects changes relative to those trust roots; it does not make the system operator-proof.

Wallet vault

Encrypted wallet-key storage and signing primitives for supported EVM and Solana routes. Policy enforcement is provided by governed execution paths, not by every vault primitive.

Secret vault

Encrypted credential storage for configured proxy routes. The proxy injects credentials server-side instead of returning them to the supported agent caller.

Policy engine

Declarative policy decisions for supported wallet routes and named provider capabilities, including argument and rate constraints.

API proxy

Configured provider calls flow through strict route matching, server-side credential injection, and audit events.

​
The problem

Agent processes are often given standing provider credentials and wallet keys through environment variables:
Code running in that process may be able to read and misuse those credentials. Rotation also requires updating every process that received the secret.

​
The Steward model

A supported agent integration can receive a Steward URL and scoped token instead:
Configured provider calls and wallet actions then enter Steward through authenticated routes. Depending on the route, Steward checks grants, evaluates policy, requests exact-action approval, signs or injects a credential, and records evidence.
Coverage is route-specific. Steward does not govern arbitrary agent network egress, every wallet operation, or every action in the product. The shipped execution authorization boundary applies to the primary EVM transaction sign path and compatible approval replay.

​
Current capabilities

  • Scoped provider grants: named capabilities support per-agent grants, expiry, revocation, strict host, path, and method matching, argument constraints, and rate constraints.
  • Exact-request approval: wallet workflows and provider capabilities can hold a consequential request for human approval and resume the approved request.
  • Primary EVM execution authorization: the primary EVM transaction sign path requires a signed, short-lived, payload-bound, backend-bound, single-use authorization before raw signing.
  • Credential proxy: configured provider requests receive credentials server-side without returning them to the supported agent caller.
  • Audit evidence: HMAC chaining, Ed25519 checkpoints, bundle export, and offline verification, with a separate out-of-band check of the bundled public key.
  • Self-hosting: Docker with PostgreSQL and Redis, or embedded PGLite for local and desktop use.
  • Custody choices: local encrypted storage, AWS KMS envelope wrapping, a PKCS#11 wrapping adapter, a versioned external-custody interface, and an EVM-only AWS KMS asymmetric signing reference provider. Steward does not claim MPC or threshold signing.

​
Direction

Steward’s direction is an open authority plane across explicitly supported agent execution surfaces. “Authority plane” is shorthand for that direction, not a claim of universal enforcement today.

Quickstart

Run Steward in your infrastructure and create a governed wallet flow.

Architecture

Understand the current execution boundaries.

React components

Add wallet, policy, and approval UI to your application.

Local mode

Run Steward locally with PGLite.

SDK reference

Install the TypeScript SDK.

API reference

Explore the self-hosted REST API.