Your agent’s
budget, sealed.

01 / create_vault

Budget, per-transaction cap, category allowlist, expiry — sealed into an encrypted record only your agent can consume, and only through the circuit. The chain holds the rules without ever reading them.

02 / HTTP 402 → spend

A paywalled API answers 402 with a price. The SDK checks the quote against the policy locally, proves the spend — about half a minute of zero-knowledge work — and the merchant unlocks the content. On the explorer: a valid proof, nothing readable.

03 / approval.requested

Set a threshold under the cap. A bigger purchase pauses mid-task on your dashboard until you answer — in our last rehearsal your approval reached the agent in 2.0 seconds. The cap is the law; the threshold is your say under it.

04 / spend.refused

Out-of-policy purchases are refused in about a millisecond — before any proof, before any payment — and land in your decline feed naming the exact rule. Refusals are what an auditor actually wants to see.

05 / revoke

Revoke consumes your admin capability and flips one public bit. The agent’s next spend arrives with a mathematically valid proof — and the chain rejects it at finalization. Enforced by consensus, not by a prompt.