# Rotate before you raise the balance

Before you raise the funded ceiling on a dedicated agent wallet or Agentic sleeve, revoke/rotate the live connector credentials (and confirm review-before-place still on) — do not top up a pipe you have not re-verified after a bad prompt, share, or long idle. Pairs with dedicated-agent-wallet, fund-session-ceiling, revoke-before-debug. Agent Lane does not place trades or hold wallets.

Canonical HTML: https://agentlane.net/guides/rotate-before-raise-balance/

## Answer first

Before you raise the funded ceiling on a dedicated agent wallet or Agentic sleeve, run rotate before you raise the balance: revoke live connector credentials, rotate tokens and grants that lived beside those connectors, confirm review before place is still on — then fund only the new ceiling. Do not top up a pipe you have not re-verified after a bad prompt, share, or long idle.

## Why raising without rotate is the failure mode

- **Stale token, bigger sleeve** — an OAuth session, API token, or open connector left after a bad prompt, share, or long idle can spend the moment you add cash.
- **Incident half-closed** — you emptied the sleeve or lowered a cap, but the live grant is still valid — topping up funds the next fill on the same credential.
- **“It’s been fine for weeks”** — long idle is not a clean bill of health. Re-verify before you raise.

Raising the balance without rotate after an incident or idle is how a larger fill happens on a stale token. Credentials first; cash second.

## What it means

1. Disconnect if still live — brokerage, payment, and payer MCP connectors off while you rotate.
2. Revoke and rotate — login grants, API tokens, OAuth sessions; mint fresh credentials you control. Full incident: [revoke-before-debug.md](./revoke-before-debug.md).
3. Review still on — [review-before-place.md](./review-before-place.md).
4. Re-verify without surplus cash — [paper-before-live.md](./paper-before-live.md) if needed; [one-connector-at-a-time.md](./one-connector-at-a-time.md) when reconnecting.
5. Then raise — [fund-session-ceiling.md](./fund-session-ceiling.md) only; caps from [agent-spend-caps.md](./agent-spend-caps.md).

## Shield stack

1. [dedicated-agent-wallet.md](./dedicated-agent-wallet.md) — money the bot can reach.
2. [agent-spend-caps.md](./agent-spend-caps.md) — write the numbers.
3. [fund-session-ceiling.md](./fund-session-ceiling.md) — empty/park excess, fund only that ceiling.
4. [review-before-place.md](./review-before-place.md) — human gate.
5. Venue — [one-connector-at-a-time.md](./one-connector-at-a-time.md).
6. [revoke-before-debug.md](./revoke-before-debug.md) — kill-and-isolate on incident.
7. Rotate before you raise the balance (this page) — credential re-verify before more cash.

## How to rotate before you raise

1. Disconnect live connectors if still on.
2. Revoke grants and rotate tokens — mint fresh credentials; do not reuse idle or logged tokens.
3. Confirm review before place is on.
4. Re-verify the pipe without surplus cash (paper / one connector if needed).
5. Then raise or fund only the new ceiling.
6. Keep the habit after long idle, share, or handoff — [shared-box.md](./shared-box.md). Overnight cash: [empty-sleeve-overnight.md](./empty-sleeve-overnight.md).

Secrets in chat: [never-paste-api-keys-in-chat.md](./never-paste-api-keys-in-chat.md) — vault or connector grant; never paste API keys, cookies, or broker passwords into the transcript.

## Practical checklist

- Raise order memorized — disconnect (if live) → revoke/rotate → review on → prove if needed → fund only the ceiling.
- No top-up on stale creds — bad prompt, share, or long idle → rotate before any raise.
- Sleeve matches the number — caps written; balance at the ceiling.
- Shared-box pass — connectors, passwords, open sessions.

Related: [never-paste-api-keys-in-chat.md](./never-paste-api-keys-in-chat.md), [session-time-box.md](./session-time-box.md), [dedicated-agent-wallet.md](./dedicated-agent-wallet.md), [fund-session-ceiling.md](./fund-session-ceiling.md), [empty-sleeve-overnight.md](./empty-sleeve-overnight.md), [revoke-before-debug.md](./revoke-before-debug.md), [agent-spend-caps.md](./agent-spend-caps.md), [review-before-place.md](./review-before-place.md), [one-connector-at-a-time.md](./one-connector-at-a-time.md), [paper-before-live.md](./paper-before-live.md), [shield-brokerage.md](./shield-brokerage.md), [shield-crypto.md](./shield-crypto.md), [shared-box.md](./shared-box.md).

## FAQ

**What does rotate before you raise the balance mean?**
Before you put more money into a dedicated agent wallet or Agentic sleeve, revoke live connector credentials, rotate tokens and grants, confirm review before place is still on, then fund only the new ceiling. Do not top up a pipe you have not re-verified after a bad prompt, share, or long idle.

**Why is raising without rotate the failure mode?**
A stale token or open connector after incident/idle can spend the moment you add cash. Caps and a dedicated wallet do not cancel a live grant.

**When must I rotate before raising?**
After any bad or suspicious prompt, after a share or handoff, after a long idle with connectors still enabled, before you bump a ceiling, and before you refill “for later.”

**Replace revoke, caps, or review?**
No — you need the full stack. Rotate before raise is the credential re-verify step before more cash.

**What do I rotate?**
Login grants, API tokens, OAuth sessions, and payer/brokerage connector credentials beside the spend path. Mint fresh credentials you control.

**Where in the shield stack?**
Dedicated wallet → caps → fund ceiling → review → venue one connector at a time. Incident: revoke before you debug. Raise/refill: rotate before raise.

## Sources

- Canonical HTML: https://agentlane.net/guides/rotate-before-raise-balance/
- Related shelf: https://agentlane.net/resources/
- Site index for bots: https://agentlane.net/llms.txt

Some product links on this site may be affiliate links. They help keep these guides free. Details: https://agentlane.net/how-we-make-money/

Contact: agentlane@agentmail.to