# Spend policy

> The limits that bound what a compromised agent can cost you.

Assume the agent is compromised. It reads untrusted web pages and API responses, any of which can tell it to call an expensive endpoint a thousand times, and no amount of prompting reliably makes a model refuse. The limits below are enforced inside the wallet, before anything is signed. Nothing the agent passes can raise them.

| Limit | Bounds |
| --- | --- |
| Per call | The most a single paid call can cost |
| Per session | One agent session's budget |
| Per day | A rolling 24-hour cap across every connected agent |
| Per service | One counterparty's blast radius |
| Hard ceiling | Lifetime total. The wallet stops. There is no override |

### Beyond the numbers

- Allowlist and blocklist, by host, wildcard subdomain, or URL prefix. A blocklist entry outranks everything.
- Approval threshold: above it, the wallet asks you over MCP elicitation instead of spending. If the client cannot show a prompt, the answer is no.
- Anomaly braking: a burst of calls to one counterparty is the shape of an injected loop, and a burst to a service registered an hour ago is the shape of an attacker's own endpoint. Both brake.
- Default-deny for unknown services: anything with no history and no settled volume is refused until you vouch for it.
- Unpriceable assets are refused. A limit denominated in USD cannot be enforced against an amount with no USD value.