Integrate your agent
Every path on this page — the sandbox, a managed identity, bring-your-own-key, a teammate's delegated request — ends at the same file: one JSON config the guard reads from. Start here if you're not sure which of the other guides applies to you.
The one call everything else builds on
POST /onboarding/agent takes a name, an action scope and spend limits, and returns a portable config: the agent's DID and signing key, its mandate, the issuer's signing keys and the URL of its signed policy bundle. The CLI, a BYOK registration and a delegated request each reach this same call from a different door — none of them are a separate integration path underneath.
Then wrap your tools
The config file is the only thing @metamynd/agentsafe-guard needs. createGuardFromConfig() reads it once; guardTool() wraps each consequential action after that. Everything downstream — which mandate applies, which Standards and SOPs fire, whether an action is held for a human or bound to a payment — is identical regardless of which door issued the config.
See it in code
{
"apiBase": "https://metamynd.ai/api/v1",
"agentDid": "did:hedera:testnet:zEEZ...",
"agentKey": "302e020100...",
"mandate": { "scope": "flight-purchase", "policyId": "pol_8f2a..." },
"bundleUrl": "https://metamynd.ai/api/v1/policy/bundle/did:hedera:testnet:zEEZ...",
"issuer": { "policyKey": "ab12...", "bbsKey": null }
}
// agentKey is returned ONCE, at provisioning. Store it; MetaMynd does not hand it
// back. BYOK registers your own key instead — see "Get an identity".