Coinbase AgentKit: Giving an Agent Tools Without Giving It Unlimited Authority

A support assistant can inspect an order and explain a refund. Letting the same assistant send the refund changes the system: a response generated from customer messages can now move funds. Coinbase AgentKit supplies the connection between an agent and onchain operations. The difficult design decision is which operations that agent should ever be able to invoke.

Research boundary: official repository and documentation reviewed November 1, 2026. The refund workflow below is proposed architecture. We did not install the SDK, create a wallet or execute a transfer.

Three components worth keeping separate

The TypeScript reference distinguishes a wallet provider from action providers. The former supplies wallet capabilities; the latter exposes operations such as reading balances or transferring tokens. A framework integration presents these actions as tools the agent can select. The LangChain extension is one documented adapter.

That separation is useful when an existing product already has a wallet service. It also means “AgentKit supports this wallet” is not a complete integration specification. Check the installed package version, selected provider, network and specific action together. Generated API references and repository examples can describe different release generations; pin the combination you actually validate.

For the refund assistant, there is little reason to expose a general-purpose transfer tool if a narrow operation can accept an approved refund ID instead. The application can resolve the destination and amount from its own order record, leaving the model to request a business action rather than compose unrestricted transaction details.

Put an approval boundary before the wallet

Conceptual refund design, not a built-in AgentKit approval flow or an observed payment test.

The distinction matters because the repository’s risk guidance explicitly says AgentKit does not itself require human transfer approval, impose spend caps or allowlist destinations. It also identifies externally supplied text as a prompt-injection risk when combined with fund-moving tools. Do not interpret the presence of a wallet SDK as evidence that an authorization policy exists.

In our proposed design, the order service verifies eligibility and amount independently of the agent’s explanation. An approval is bound to the exact refund request. If a later tool call changes the recipient or value, the old approval should no longer authorize it. These are application requirements, not features automatically supplied by AgentKit.

Wallet ownership changes who can stop the action

A provider can connect to different account models. For example, CDP’s account documentation distinguishes user-owned wallets from server-controlled API-key wallets, as well as EVM EOAs, smart accounts and Solana accounts. Do not flatten those differences into “the agent has a Coinbase wallet.”

A server-controlled refund wallet gives the application operator a different responsibility from a user wallet that requires the user’s authorization. Record whose funds are held, which service can sign, which credentials an operator can revoke, and what recovery remains possible if the agent process is compromised. Avoid exposing signer credentials to the model context or returning them in tool output.

A useful action needs a useful result

For a payment action, returning a transaction hash is only the beginning. The downstream order system needs to distinguish a proposed call, an accepted submission, a confirmed successful transaction and a failed execution. The agent’s natural-language response should be generated from that structured state.

Proposed acceptance check	Expected product behavior
A customer message includes a replacement destination	Refund still uses the verified order record
The same refund request reaches two workers	One business refund is authorized and reconciled
A wallet call times out after submission	Query the prior attempt before creating another
The operator disables refunds	New signing requests stop at the enforced boundary
A balance-reading task receives an injection	It cannot access a payment tool it was never given

These are tests a team should implement, not results we observed. They turn the broad promise of an autonomous agent into a reviewable operating contract.

When AgentKit fits

AgentKit is a sensible component to investigate when developers want to compose their own agent framework, wallet provider and onchain actions. It leaves substantial product engineering around permissions, recovery, receipts and operational limits. Teams looking for a packaged wallet experience should separately examine Coinbase Agentic Wallets; the shared company name does not make the two products interchangeable.

For the refund assistant, a good first milestone is a read-only integration followed by a narrow, approval-bound testnet action. There is no need to grant an entire toolkit of money-moving operations to validate whether one business workflow is useful. Continue with the AgentKit reference and spending-limit guide.