MetaMask Agent Wallet Is Live: What Guard Mode vs. Beast Mode Actually Limit Your Agent To

A mechanism that lets a user (or the system itself) immediately halt all of a <a href="/en/glossary/defai-fundamentals/defai/">DeFAI</a> agent's automated actions — typically a final layer of manual intervention retained outside the normal permission scope, used to respond to abnormal agent behavior or emergency market conditions.

Authorizing an agent fundamentally involves two completely opposite design philosophies: an allowlist defaults to nothing is permitted, with only explicitly listed actions allowed to execute; a denylist defaults to everything is permitted, with only explicitly listed actions forbidden. These two designs produce completely opposite outcomes when facing a new scenario never considered before — a foundational design choice that determines an authorization system's actual security boundary.

The situation where an agent's authorization to two or more independent protocols each looks reasonable on its own, but because these protocols are composable underneath, an interaction you never anticipated exists between them — combined together, these authorizations can achieve an effect far beyond what you originally expected when authorizing any single protocol alone. A permission risk that stems from the compositional nature of the DeFi ecosystem itself, not a design flaw in any one link.