Daily budgets, velocity gates, wallet locks, and policy-as-code sit on every agent — not on the human behind it. Runaway spends stop at the edge.
Isolation first
Limits, velocity, locks and key control are keyed by owner/repo — never by the human session.
Spend ceiling resets each UTC day. Nothing crosses it.
Tx count and USD rate limits stop runaway loops in seconds.
Freeze all debits without deleting the agent identity.
Kill one credential. Leave the rest of the agent live.
Edge interceptor
The ledger never trusts the agent. Policy, budget, velocity, lock state and key status are evaluated in order — any failure stops the spend.
allow_to / deny_to / max_amount / task prefix evaluated first
UTC day ceiling. Spent amount already counted against it
Tx count + USD windows + spike detector in the last second
If locked, every debit is rejected with reason logged
Suspended credentials cannot sign or spend
Design rules
Daily budget, velocity windows and lock state are stored against the bound owner/repo. Changing who is logged in does not reset or bypass them.
Caps, spike detection and wallet locks are isolated per agent identity. A compromised or looping credential only affects its own ledger balance.
Safety events (lock, velocity hit, policy deny, key suspend) are written to the ledger with reason and timestamp. Nothing is silent.
Policy-as-code
Allow lists, deny lists, amount caps and required task prefixes are bound to the owner/repo. Switching the human session never resets or overrides them.
Evaluated before every debit. A key cannot override a deny list that belongs to its own agent identity.
Telemetry
Every blocked spend, lock, velocity hit and key suspension is written to the ledger with reason and timestamp. Webhooks fire for the critical ones.
Credential isolation
API keys are disposable. The owner/repo identity, its balances, its policy and its safety limits continue uninterrupted. One compromised credential does not take the agent offline.
No human in the loop
Several safety actions run automatically. Holds expire, spikes are intercepted, and locked wallets stay locked until an explicit unlock.
Time-limited holds and ephemeral sub-wallets return unspent balance to the parent when the TTL ends. No manual cleanup required.
A sudden burst of transactions in a single second is detected at the edge and rejected before the spend lands.
Once locked, every subsequent debit is refused with a reason. Only an explicit unlock from the owner can reopen it.
Old velocity and safety events are cleaned on a schedule so the ledger stays lean without losing recent evidence.
What this means
Daily budgets, velocity gates, policy rules and wallet locks contain the damage to a single owner/repo. One bad agent never becomes a systemic event.
Open Safety controlsWhat the agent can do
The bound owner/repo is the only identity the ledger recognizes. Keys come and go. The agent remains.
What the edge always does
No spend reaches the ledger until every gate has passed. Failures are logged and, when critical, pushed out as webhooks.
Now
Bind a repo. Set the limits. Agents spend — the edge keeps the rest safe.
Join AgentPay│
