> For the complete documentation index, see [llms.txt](https://docs.sail.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sail.money/sailor/concepts/keys-and-custody.md).

# Keys & custody

Sailor operates the Protocol's [three roles](/protocol/concepts/roles.md). Each maps to a key Sailor handles differently — and the differences are the heart of the safety model.

| Role                  | Key                                 | Where it lives                                          | Who signs with it                   |
| --------------------- | ----------------------------------- | ------------------------------------------------------- | ----------------------------------- |
| **Owner**             | Your wallet (MetaMask, Rabby, …)    | Your browser wallet — **never read by Sailor**          | You, in the browser signing server  |
| **Permission Signer** | Same as owner, or a separate signer | Your wallet / signer                                    | You, authorizing mandate operations |
| **Manager** (agent)   | The agent wallet                    | `.sail/keys/manager.json`, encrypted (geth keystore v3) | Sailor, automatically, per dispatch |

## The owner key is never in the terminal

Owner and permission-signer signatures (creating the SMA, registering or revoking permissions) are deliberate, custody-affecting actions. Sailor routes them through a local **signing server** — an HTTP + WebSocket daemon that serves a browser UI:

```bash
sailor signer start &     # the signing daemon
sailor owner connect       # connect your wallet in the browser, persist it as owner
```

The agent (and any coding assistant operating Sailor) **never holds the owner key**. It pushes signing requests to the signing server; you approve them in the browser; then the agent submits the transactions it's allowed to. This is why a coding agent can drive setup without ever being trusted with custody.

## The manager key is encrypted and scoped

The manager (agent) key is generated with `sailor keys generate` and stored encrypted at `.sail/keys/manager.json` (scrypt + aes-128-ctr). It signs dispatches — and **only** dispatches. By the [signer-separation guarantee](/protocol/security/guarantees.md), the manager cannot register or revoke permissions and cannot exceed any registered permission's bounds. Unlock it non-interactively (CI, headless runs) by setting `SAIL_PASSPHRASE`; never commit it.

Addresses passed to the CLI are normalized to EIP-55 checksum before any on-chain call or state write.

## Custody never leaves the Safe

Capital is held in the owner's Safe. Sailor cannot move it except through a manager dispatch that satisfies a registered permission — and even then the funds move via the Safe's own module path, not through Sailor. You can sever the agent instantly without touching custody:

```bash
sailor session pause       # revoke dispatch rights; sailor session resume to restore
```

Pausing the session blocks every dispatch while leaving the Safe, its balances, and the mandate intact. Rotating the agent key (`sailor account rotate-signer`) clears the mandate and re-approves it for the new key — see [CLI → SMA lifecycle](/sailor/cli.md#sma-lifecycle).

{% hint style="info" %}
Custody is protected by construction, but **a mandate is only as correct as its permission contracts**. The key model prevents the agent from exceeding the mandate; it does not make a permissive mandate safe. See [Build & register a mandate](/sailor/guides/build-a-mandate.md) and the Protocol's [security limitations](/protocol/security/limitations.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.sail.money/sailor/concepts/keys-and-custody.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.