Portable Wallets Need an Owner for the Off Switch

Analysis | October 14, 2026.

The October 13 announcement promises further controls. Yet Privy’s XRPL documentation already describes policy enforcement. These materials leave rollout scope unresolved. A specification does not establish what a particular app has enabled. The more durable question is how control changes when an owner moves wallets, loses access, or stops an automated spender. Our analysis separates those situations because demonstrating one successfully does not prove the others work.

Export is a migration test

Privy’s export guide makes export routes depend on the wallet’s creation environment. For a product team, the useful test goes beyond finding an export button. Start with a fictional owner who can make an approved payment. Move that owner to a different interface in a test environment. Can they still identify their account, understand its permissions and complete the same permitted action?

Then test the restriction. Ask the new interface to perform an action the old arrangement would reject. Record whether the restriction survives, disappears or needs to be rebuilt. This is a proposed acceptance test, not a claim that a particular implementation permits a bypass. A portability promise should explain both what the owner gains and which responsibilities move with them.

The distinction matters commercially. A clean exit process could reduce dependence on one application, while a poorly explained change in safeguards could increase the owner's operational burden. An export count alone would miss that trade-off.

Recovery should restore the right authority

XRPL’s key-management guide requires another authorization method before disabling the master key. Our broader design question is what a recovery process restores. Recovering a login, recovering the ability to sign, and recovering authority to change permissions should be evaluated separately.

Consider an owner who loses a device while an agent is still authorized to act. A recovery exercise should establish who can intervene, what evidence they must provide and which previous permissions remain. It should also test an unsuccessful recovery attempt: a person who knows the account name but lacks the required proof should not gain control.

A useful completion record would show two outcomes together: the legitimate owner can act again, and any authority meant to be retired has actually stopped working. Restoring convenience without checking the second outcome is an incomplete test.

Name the person who can stop spending

Privy’s control model assigns wallet ownership to a key or key quorum. Our proposed review then asks a human question: who is responsible for using that authority when something goes wrong?

For a hypothetical agent wallet, document the party allowed to request spending, the party allowed to change limits, and the party allowed to terminate permission. These roles may overlap, but the overlap should be deliberate. A finance operator's ability to observe activity should not be mistaken for the authority to stop it.

The most revealing exercise begins after permission has been withdrawn. Submit a fresh request using the former authority and verify rejection. Separately inspect requests already signed or submitted, rather than assuming that a successful revocation message resolves every earlier action. The test should distinguish stopping new authority from investigating existing work.

Measure what fails safely

These exercises suggest a better procurement question than whether a wallet supports a list of features: can the intended owner preserve control through a change of interface, a loss of access and a withdrawal of delegation?

A credible answer would include test results, named responsibilities and explicit limits. It would explain which protections were preserved, which were intentionally replaced and which depend on another party being available. That evidence would make portability meaningful without turning recovery into a vague promise or an off switch into an unattended responsibility.