This guide crosses several on-chain roles. Use separate keys for the ComplianceProvider owner, principal, agent, AgentExecutor owner, enforcer, and optional relayer. Never paste them into a shared shell history.
Prerequisites
BRICKKEN_API_KEY for reads and typed-data fetches- Sepolia native gas for every client-signed role
- x402 payment asset for the wallet executing CLI sends
- AgentExecutor granted
RECORDER_ROLE on AgentMandate
- A distinct
ENFORCER_ROLE wallet (the registry admin cannot be its enforcer)
- Principal token allowance granted to the executor before value-moving execution
1. Grant principal eligibility
Configure the ComplianceProvider owner key, then:
Confirm it with brickken rams compliance-status --chain "$CHAIN" --principal "$PRINCIPAL" --identity-ref "$IDENTITY_REF".
2. Sign and relay the mandate
With the principal key configured, create signature.json using rams sign. Switch to the relayer/payer key and run rams grant with the exact same fields, signature, and deadline.
Then inspect:
With the executor-owner key, register ERC-20 transferFrom(address,address,uint256) (0x23b872dd). Its amount is ABI word index 2:
The principal must separately call approve(EXECUTOR, allowance) on ASSET.
4. Check and execute
The execute command must use the agent key and cannot be Brickken-relayed.
5. Enforcement and lifecycle
An enforcer can freeze/unfreeze the agent globally:
Finally, the principal or approved operator can revoke the mandate directly, or the principal can sign a relayed revocation. Re-run inspect and can-execute; a revoked mandate remains recorded but is inactive.
Do not run this sequence against the shared deployed contracts until the chain-ops roles and token allowance are confirmed. Failed on-chain writes can still consume native gas and x402 payment.
