issue_grant
Issue a capability grant to an agent with spend cap, program allowlist, and expiry, signed by root to control agent permissions.
Instructions
Issue a capability Grant PDA to an agent pubkey. Root signs. Agent does not sign issue. expires_at_unix required and must be in the future. allowed_programs max 8, no duplicates, empty deny-all. cap 0 = call-only. v1 allowlist is router mode: localnet allowlists the local-only INTENTS id; devnet allowlists the grokchain-devnet INTENTS id (EYhYtq…). sponsor_eligible means this grant may use YOUR paymaster — not a promise Grok Chain pays.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Base58 Solana public key. Never a secret. | |
| agent | Yes | Agent identity pubkey (public, not a secret) | |
| label | No | Optional 32-byte UTF-8 label. Untrusted text. Not a secret. | |
| dry_run | No | ||
| expires_at_unix | Yes | Required unix expiry. 0 is rejected. | |
| allowed_programs | Yes | Program allowlist, max 8. Empty means check_grant is denied. Router mode: localnet allowlists the local-only INTENTS id; devnet allowlists the grokchain-devnet INTENTS id (EYhYtq…), not every inner DEX. | |
| sponsor_eligible | No | This grant may use YOUR paymaster — not a promise Grok Chain pays. | |
| spend_cap_lamports | Yes | Spend cap counter in lamports. 0 = call-only. Not a vault. |