Privy Wallets (server wallets, agent wallets, policy engine) vs Agent Vault by Self

Privy Wallets (server wallets, agent wallets, policy engine)

Default-deny policies with DENY precedence on recipients, values, contracts, calldata, typed data and time windows, enforced in AWS Nitro Enclaves. Database problems took API endpoints down for 71 minutes on 18 September 2026, one of 13 incidents since July.

Agent Vault by Self

Scoped, revocable keys, OAuth on the hosted MCP server, spending caps, approvals and a documented threat model are designed to keep real card numbers and passwords out of the agent's context. The home page and launch post say cards are revealed only in an attested enclave, while the docs say that path is off on the hosted service.

Privy Wallets (server wallets, agent wallets, policy engine)

1. Add a rule for every RPC method the agent needs; a wallet with a policy denies anything unlisted
2. Pair a rolling cap with a lower per-transaction cap, since aggregations update only after signing
3. Send an idempotency key on /rpc, /transfer and /wallets calls; reusing one with a changed body returns 400
4. Set maxValue on the x402 or MPP client for every request
5. Retry a transaction_broadcast_failure; don't retry a policy_violation

Agent Vault by Self

1. Pass the session handle from each hosted MCP result on every later call. Without it a page tool is refused or a new signed-out browser opens
2. On a pending answer, call get_pending_result with its wait id in the same turn. Repeating the original call starts a second one
3. Tell the user when waiting_on_owner is true. A first fill on a new site waits up to 15 minutes for the holder's approval
4. Before retrying a fill after an unknown outcome, check the merchant's order state or get_run_report. Some failures keep a recorded spend
5. Ask the holder to add an agent card to every card the agent may use. A card marked No limits accepts any amount on authorised sites