A Hybrid Key Architecture for Autonomous Agent Credential Management

AI agents that move money on-chain have a problem nobody talks about cleanly: who holds the keys? That's the problem I ran into building Fishnet , an AI agent transaction security proxy in Rust. Fishnet sits between the AI agent and the chain — a control plane that necessarily holds signing keys. You can't give it zero secrets. So the question becomes: how do you minimize blast radius when secrets are unavoidable? The naive answer is to pick one storage primitive and use it for everything. That breaks down immediately when your system has multiple cryptographic operations with different security requirements. Keychain is good for secret storage but not the same thing as hardware-backed signing. In this flow, Secure Enclave gives me P-256, while Ethereum signing requires secp256k1. File storage is portable, but it mostly relies on filesystem permissions rather than hardware isolation. The answer I landed on: use the right storage primitive for each key's threat model, and compose them b