Browse all documentation
Documentation home
Get started
Platform overviewConnect a walletSafety, simulation, and signing
Find names
Expiry ExplorerAI domain searchDiscover and collectionsBulk searchENS lookup and domain details
Trade names
Browse the marketplaceBuy a listed nameList a name for saleBulk list namesActivity and collectionsMake, manage, and accept offersLeaderboard and market analyticsLive market pulse and network activity
Manage names
Portfolio dashboardPublic Portfolio 2.0Renewals and gas planningBulk edit records and resolversTransfers and subnamesSet a primary ENS nameWatchlist and notificationsLive calendar subscriptionsSaved-search monitorsUnified action inboxPublic profiles and share cards
Agent platform
Agent platform overviewLaunch an ENS-native agentAgent directory and profilesCapability health checksIntent routingPolicy-bound agent sessionsAgent jobs, quotes, and escrow evidenceCreate and control agent fleetsControl-plane canary evidence
Developers
MCP quickstartComplete MCP tool catalogueDeveloper accounts, sandbox, quotas, and Base subscriptionsUnsigned transaction plansAgent identity standardsPublic APIs and manifestsMarketplace integration
Reference
ENSv2 public betaENS lifecycle and status meaningsFees and displayed totalsTroubleshooting
Agent platform · 6 of 9

Policy-bound agent sessions

Create short-lived, scoped, signed, and revocable authorization.

experimentalagent-policy v1 · execution-permission v1Verified 2026-07-29Owner: ENS.Tools Agent Authorization
Open this feature

A policy is an EIP-712 envelope that a compatible executor can enforce before privileged operations. Wallet-native execution permissions add session keys, exact targets and selectors, call limits, and cumulative value. The durable authorizer resolves ENS live and commits usage atomically.

Issuer and ENS grantee with optional resolved-address binding.
Exact allowed MCP tool names.
Allowed ENS name suffixes.
Maximum attached ETH value and expiration.
Public issuance event, live verification, lookup, and signed revocation.
EOA and ERC-1271 execution-policy signatures with ERC-7715 wallet permission preparation.
Append-only, idempotent authorization receipts with atomic call and cumulative-value limits.
Zero-dependency JavaScript SDK and Express/Connect fail-closed middleware.
Production contract

Before you run this workflow

Networks

  • Ethereum mainnet EIP-712 domain
  • Wallet-selected execution chain where supported

Prerequisites

  • Issuer wallet
  • ENS grantee resolving to the intended agent wallet
  • Compatible fail-closed executor

Wallet permissions

  • EIP-712 policy signature
  • Optional ERC-7715 permission request and ERC-7710 delegated execution

Expected result

  • Published policy
  • Live verification decision
  • Append-only idempotent usage receipt

Errors and recovery

  • Publish signed revocation
  • Expire short sessions
  • Deny execution when identity, policy, usage, or simulation evidence is unknown
Workflow

How to use it

  1. 1

    Define the smallest scope

    Name only the tools, ENS suffixes, value ceiling, and duration the agent needs.

  2. 2

    Prepare and read the envelope

    Confirm issuer, grantee, resolved address, chain, policy ID, and human-readable limits.

  3. 3

    Sign and publish

    Sign the EIP-712 data, then publish the signed envelope so compatible executors can verify it.

  4. 4

    Simulate the exact use

    Collect fresh identity and endpoint evidence and simulate the intended target, selector, and value.

  5. 5

    Authorize every execution

    Call authorize_agent_execution with one stable idempotency key. Proceed only when execution.mayProceed is true.

  6. 6

    Retain the receipt

    Store the request hash and append-only usage receipt with execution evidence. Retrying the same key does not consume the limit twice.

  7. 7

    Revoke when needed

    Prepare and sign the revocation, publish it, and confirm that subsequent verification fails closed.