The master wallet owns the decision
The master account is the address whose positions and balances the Info API returns. A common integration mistake is querying the agent address and getting an empty or misleading account view.
The agent wallet signs actions
approveAgent registers an API wallet that can sign on behalf of the master or a subaccount. That permission can be useful for automation, but it should never be confused with read-only wallet intelligence.
Cannot withdraw does not mean cannot lose
An API wallet cannot withdraw funds, but it can still place or cancel trades after approval. Set notional, size, and daily caps, keep a kill switch, and make revoke easy to find.