Spend controls for autonomous agents
Your agent asks for a plan, not a payment.
It shops the task first — discovers real sellers, collects live quotes — and returns one priced, reasoned plan. A single approval funds a single-use envelope holding exactly the ceiling you approved. The agent then runs unattended inside it and cannot exceed it, because the money is not there to exceed.
What the human receives
“Vet 3 counterparty wallets before I pay them”
vetting.planbound.eth
Logic: Screen every address for sanctions first, then price risk on the ones that clear · self-checked ×2
- dropped one dead endpoint
- deduped two steps on the same host
| Wallet Risk X-RayA sanctioned counterparty voids the rest of the vetting | $0.05 live |
| Market diversityA thin market means the risk score is not meaningful | $0.02 live |
| Total quoted | $0.07 |
Approving funds a single-use envelope with exactly this ceiling.
The problem
Neither of today’s answers is consent.
An agent that spends either holds a funded key — no budget, no scope, no kill switch — or interrupts its human on every call until the interruptions stop meaning anything.
of Claude Code permission prompts are approved. The popup arrives without the context to judge it, so it gets rubber-stamped. Consent that always says yes isn’t consent.
Anthropic’s own data, cited in The Human-in-the-Loop Illusion, 2026.
of x402 endpoints publish a price at all. No total for a task exists before it runs — the plan is the first moment anyone, human or agent, knows what it costs.
TOLL·402 census of 78,290 routes, 2026-07-10.
How it works
Four steps, one of them yours.
The agent does the shopping. You answer one question, once, with the whole task priced in front of you.
The agent shops the task
It searches the x402 Bazaar, Coinbase’s keyless public catalog, and probes each candidate for a live HTTP 402 quote. A listing is a claim; the probe is the fact. Sellers sitting behind a bot wall never reach a plan.
It comes back with one priced plan
Every step carries what it buys and a one-line why it earns its price. Live quotes are stamped apart from estimates — an estimate is never dressed as a quote. Before you see it, the agent has graded the plan against your goal and fixed what failed.
One approval funds the envelope
Approving mints a single-use account holding exactly the ceiling, keyed 1-of-[2-of-2(agent, policy), treasury]. Approval is not consent to a transaction. It is the creation of the budget.
The agent runs unattended inside it
It pays sellers out of that same account, co-signed step by step against the plan you approved. It cannot exceed the ceiling, because the money is not there to exceed. What it does not spend sweeps back at expiry.
Others give the agent a funded wallet and enforce the limit in their own service. We give the agent zero funds and let consensus enforce the cap.The one-sentence difference
When reality drifts
The agent hits a wall. You get a diff, not a popup.
A step that asks more than it quoted stops there — the funds and the co-signer both refuse. What reaches you is what already settled, what changed and by how much, and the price of every way out.
In our own run, a step quoted at $0.01 met a real seller asking $0.05. The gate blocked it even though the envelope held enough to pay, because the plan the human approved was not the plan the agent found.
Finish
Top up the exact shortfall and let the run complete at the new price.
Re-plan
Re-price the remaining steps. Everything already delivered is kept.
Abort
Stop now. The sweep returns the remainder, and you keep what was bought.
A real run, end to end
Every cent of the ceiling, accounted for.
One loop on Hedera testnet: two services quoted, a human approved on their phone, an envelope minted holding exactly the ceiling, and the agent bought from the seller paying out of that same account. Quoted equals paid; the remainder came back.
ceiling — nothing crosses this edge ↑
PaidTwo steps, settled from the envelope itself
$0.0350Swept backReturned to the treasury when the plan closed
$0.0115Left behindThe sliver the sweep leaves so the transfer fee can be paid
$0.0035
Stated plainly
- Hedera testnet, faucet funds. Mainnet purchases stay impossible until you turn them on yourself.
- The reference seller on the Hedera rail is ours, and the code says so — no Hedera x402 seller market exists yet. Every other seller is a stranger discovered through the Bazaar.
- Per-service policy logic runs off-chain. The 2-of-2 key is what makes bypassing it impossible.
- The rest of what is and isn’t proven is in the honesty box, in the README.
Built on
Each piece does real work.
The README points at the exact lines where every one of these lives, so nobody has to grep for them.
The envelope account, its 2-of-2 threshold key, the scheduled refund at expiry, the receipt trail on HCS — and the purchase itself, so the thing that enforces the cap and the thing that pays are one account.
Discovery, live 402 quoting and payment through one scheme-pluggable client across Hedera, Base and Worldchain. The gate sits in the only path money leaves by.
Claimed against settled. Our database records what the control plane claims; the subgraph records what settled on-chain. The console diffs the two, so you can check us against the chain.
Identity as step-up: a large ceiling asks for a second factor before the approve button does anything, enforced server-side rather than in the UI.
An agent’s name resolves to what it is currently allowed to spend — authority published as text records, verifiable without an API of ours.
See a plan, priced and reasoned.
The console lists real plans with their receipts and diffs what we claim against what settled on-chain. The agent side is an MCP server and a Claude Code plugin — seven tools, and your key never leaves your machine.