AgentRailCustody is pluggable. The policy engine is not.
Key management is a solved, commodity problem. AgentRail doesn't try to reinvent it — it sits in front of whatever signer holds the keys, and refuses to let a request reach that signer unless it clears the policy first.
Local keystore
Keys are encrypted at rest on the machine running the signer. The agent requests a signature through the policy path and gets back either a signed transaction or a refusal — it never sees a private key, and neither does anything upstream of the signer.
Managed custody
The signer sits behind a small interface — hand it a transaction, get back a signature or a refusal. That's deliberate: a managed or HSM-backed signer can be dropped in behind the same interface later without changing anything about how policy is evaluated.
Whoever holds the keys still answers to the policy.
What never changes
Regardless of which signer is behind it, every payment still goes through the same path: the policy engine decides, the signer signs or refuses, the transaction submits, the receipt is recorded. Swapping the custody backend changes who holds the key. It does not change who decides whether it gets used.