AI agent authorization, enforced before the money moves.

Cap kit spend. Gate external calls. Keep humans in the loop.

Spend policy is per agent and off by default. Enable it with PATCH /agents/:id/spend-policy, stored as metadata.spendPolicy. Run it in advisory mode first. Advisory records what the policy would have decided without blocking anything, so you can tune against real traffic before it enforces.

Precept fields

• Kit-priced tools

  Covered. Fixed-price MCP tools where the amount is known before the call. Spend policy runs first, then payment requirements, then verify, execute and settle.

• Variable third-party APIs

  Not covered. Where price is only known after the response, a cap has nothing to compare against. The host allowlist and discovery filters apply instead. Abstraxn states this rather than implying a control it cannot enforce.

• On-chain transfers

  Not covered. Signing stays in your wallet, so a raw transfer sits outside the kit. Recipient allowlists belong in your application, next to the key that signs. Abstraxn never holds that key.

The kit does not replace your approval UI. It creates natural pause points.

• Above the per-call ceiling

  amount

  The amount clears the period budget but exceeds the single-call cap. The agent gets a hold rather than a denial, and the approval carries through as a one-off.

• First payment to a new host

  new_host

  The host is not on the allowlist yet. Approving once adds it, so the second call to the same host clears without interrupting anyone.

• A recurring commitment

  commitment_shape

  A subscription binds future periods, so it is treated differently from a one-off of the same amount. Recurring shape escalates unless it was authorised by name.

• Anything a dry run flagged

  dry-run

  Advisory mode records what the policy would have denied without blocking it. Promoting that rule to enforcement turns those records into pause points before it starts refusing.

1. 1

   State what the agent may spend

   A person describes the limits in plain language. The Intent Compiler turns that into typed constraints. Anything it cannot enforce is declined out loud, never quietly guessed.

2. 2

   Confirm and seal the Precept

   The person approves the structure, not the sentence. The confirmed version is signed, versioned and hash-anchored in the Precept Ledger. An amendment creates a new version rather than editing the old one.

3. 3

   Check every proposed action

   The Authority Gate is the component that checks each proposed action. It evaluates amount, window, category, host and commitment shape against the sealed Precept. Allow, deny or escalate, before x402 requests payment.

4. 4

   Verify the receipt without us

   Every outcome is receipted, refusals included. The Open Verifier is open-source software that runs offline and checks any receipt against the Precept it cites. No Abstraxn account is required.

• Decide before, audit after

  A control that only reports after settlement is monitoring, not authorization.

• Refusals are the product

  A denial naming the failing rule and a retry shape is worth more to an agent than a silent success.

• Never touch the money

  Abstraxn holds no funds, issues no spendable credential and initiates no payment, which is exactly what makes neutral verification possible.

• State the boundary

  Abstraxn publishes what spend policy does not enforce, because a control you cannot describe precisely is a control nobody trusts.

• Verifiable without us

  The verifier is open source and runs offline, so no part of the trail depends on Abstraxn continuing to exist.

• Identity Layer

  AI agent identity and authentication answer who is acting. Agent authorization answers what it may do. A payment check needs both.

• Wallet Stack

  Embedded wallets and ERC-4337 account abstraction hold the keys, so signing stays with you while the policy check sits in front of it.

• Discovery Layer

  The MCP server directory quotes a kit price before the call, which is what makes a cap checkable rather than estimated.

• Payments Layer

  x402 requests payment only after authorization clears, so nothing is charged against a Precept that already failed.

• Settlement Layer

  Stablecoin settlement records the Precept that authorised each payment, so the money trail and the authority trail reconcile against each other.

• KYI · Agent Authorization

  You are here

  Set what an agent may spend. Check it before every payment. Receipt every outcome, refusals included.

Spend policy is a PATCH on the agent object. Two MCP responses carry the decision forward. Payment Required (402): approve or sign, then retry with paymentPayload. Spend Policy Denied (-32403): see error.data.spendPolicy for the failing rule, remaining allowance and retry shape.

PATCH /agents/{agentId}/spend-policy
Authorization: X-API-Key (application key)
{
  "enabled": true,
  "budgetUsd": "5.00",
  "period": "daily",
  "hardBlock": true
}

Signing stays with you. Enforce recipient allowlists and transfer limits in your application, next to the key. Abstraxn never holds that key.