Spend policy

The limits that bound what a compromised agent can cost you.

Assume the agent is compromised. It reads untrusted web pages and API responses, any of which can tell it to call an expensive endpoint a thousand times, and no amount of prompting reliably makes a model refuse. The limits below are enforced inside the wallet, before anything is signed. Nothing the agent passes can raise them.

Limit	Bounds
Per call	The most a single paid call can cost
Per session	One agent session's budget
Per day	A rolling 24-hour cap across every connected agent
Per service	One counterparty's blast radius
Hard ceiling	Lifetime total. The wallet stops. There is no override

Beyond the numbers

Allowlist and blocklist, by host, wildcard subdomain, or URL prefix. A blocklist entry outranks everything.
Approval threshold: above it, the wallet asks you over MCP elicitation instead of spending. If the client cannot show a prompt, the answer is no.
Anomaly braking: a burst of calls to one counterparty is the shape of an injected loop, and a burst to a service registered an hour ago is the shape of an attacker's own endpoint. Both brake.
Default-deny for unknown services: anything with no history and no settled volume is refused until you vouch for it.
Unpriceable assets are refused. A limit denominated in USD cannot be enforced against an amount with no USD value.

Custody