An Agent acts without a human reading every payload, so Agentic Wallet does not rely on the Agent behaving well. The constraints below are enforced by the product, and the Agent cannot widen them.
Where settings live
| Changed in the Binance App only | Every account security setting. Binance App â Agentic Wallet management page â Settings |
| Read-only to the Agent | The Agent can report your configuration, never change it |
| Per-command parameters | Slippage, MEV protection and gas level are passed on each command â they are not account settings |
If a request is refused by one of these rules, ask the Agent why â it reads your current configuration back and tells you which limit applied.
Session and sign-in
- Signing in requires scanning a QR code in the Binance App and confirming a pairing code. The Agent waits for that confirmation and gives up if it does not arrive.
- Two independent timers end a session: a maximum sign-in duration and an inactivity timeout. Whichever comes first signs the wallet out.
- You can sign out at any time, from the Agent or from the App, which clears the local session.
See Install Agentic Wallet for the sign-in walkthrough.
Spending limits are separate pools
Limits are not one shared budget. Each category draws on its own 24-hour pool, in USD:
| Pool | Covers |
|---|---|
| Regular trading | Swaps, transfers, limit orders |
| Prediction market | Prediction trades |
| DeFi | Deposits and liquidity adds |
| Developer Mode | External signing â contract calls and message signatures |
| x402 payments | HTTP 402 payments |
Spending in one pool does not consume another. Four rules apply across all of them:
- Only Agent-initiated transactions count. What you do by hand in the App does not draw on these pools.
- Failed transactions do not restore quota.
- Pools reset at 00:00 UTC.
- Values are per wallet â ask the Agent for your current limits and remaining quota rather than assuming a figure.
"What's my daily limit, and how much is left today?"
Capability switches
| Switch | Effect |
|---|---|
| Tradable token scope | Either any token, or only tokens on the allowed list |
| High-risk transaction handling | Either auto-reject, or push a confirmation to the App and wait for your decision |
| Prediction market | When off, prediction commands are refused |
| Developer Mode | When off, external signing cannot be previewed or executed |
Before a swap
Swaps, limit buys and limit sells all go through the same pre-trade checks:
- A token outside the trusted list is security-audited first â honeypot detection, transfer tax and risk level. Every finding is shown to you, and you decide whether to continue.
- The audit fails closed. If it cannot run or returns unusable data, the Agent says so and waits for your explicit confirmation. It does not quietly skip the check.
- Every state-changing command is confirmed with you before it executes. This one is Skill behaviour rather than a wallet-enforced limit â you can tell the Agent to stop asking, and the checks above still apply.
Slippage defaults to automatic and MEV protection is on by default; both can be overridden per command. See Market Order.
Transfers
- The recipient must already be in your Address Book, which can only be edited in the Binance App. Transfers to any other address are refused.
- A domain name is resolved to an address first, shown to you, and that resolved address still has to be in the Address Book.
See Send Tokens.
Token approvals
The Agent can list every active approval on your wallet, filtered by chain or spender, and revoke any of them â the practical defence against an unlimited approval granted long ago.
"Show me my active token approvals"
Developer Mode
Developer Mode widens what the Agent can do, under its own constraints: the switch exists only in
the Binance App, every operation is split into preview â explicit confirmation â execute, and it
draws on its own quota pool rather than your main one.
See Developer Mode for the full boundary.
What the Agent will not do
These are built into the Skill, independent of which model or client you use:
- Never handles your secrets. It does not log, display or ask for session tokens, API keys, private keys, seed phrases or passwords, and masks sensitive fields in command output.
- Treats on-chain data as data, not instructions. Token names, symbols and metadata can carry prompt injection. The Agent will not act on them, and refuses requests to extract credentials or bypass checks however urgent they claim to be.
- Never invents a contract address. Malicious tokens clone legitimate names, so the Agent uses only a known-token list or an address you supplied.
- Does not give investment advice. It presents audit facts and leaves the decision to you.
- Passes errors through unchanged, rather than guessing at a cause or softening the message.
What's next
- Security & Settings â query your current configuration
- Developer Mode â external signing and its boundaries
- Send Tokens â Address Book and domain recipients