Bounded, revocable spending authority for AI agents.
The agent is assumed compromised. That is the premise, not a caveat.
Eight constraints. Six hold with no model running at all; the two that need one can refuse, never authorise.
The budget lives in a Biscuit capability token signed by the root key. A block can only narrow the ceiling, never raise it. An agent that tries to spend more is refused before any network call.
depth = token.block_count() - 1. An agent that fills in its own depth is recorded as evidence, not believed. A longer chain means a narrower agent, by construction.
Every payment attempt is counted against the mandate's running balance before clearing. Reservation holds the balance until the payment settles or the TTL expires.
A unique key per payment attempt. Replays within the TTL are caught and deduplicated — a gap Razorpay's Orders API leaves open. The gateway closes it.
The agent that reads seller-written pages holds ("search",) and a budget of zero; the agent that pays holds ("pay",) and cannot search. Siblings, not a chain — a child would force the payer to hold search for it to inherit. Above them it is weaker and we say so: attenuation cannot express grant without use, so a branch holds everything it confers and is stopped by the gateway, not by the token.
An optional model call judges intent against cart contents, and all three verdicts now act: allow, defer — settle a smaller amount — and escalate to a person. Switching it off removes no cryptographic guarantee. It fails open, so exhausting a quota removes the second layer rather than blocking the first.
Every bound above is arithmetic, and a decomposition can divide its budget perfectly while buying the wrong things. A second model reviews each split at the one seam that matters — after the bounds, before any token is minted. It can refuse or escalate; it can never authorise. Unreachable, the run proceeds exactly as it would have without it.
A supplier's own review count is a field it fills in. This record is written by the gateway at settlement — who was paid, and how each dealing went: refusals, escalations, human vetoes, pages that addressed our agent instead of describing goods. A tally is not a reputation, so concerns lead.
One task becomes a tree. Every edge appends a block to the token above it, so each layer is strictly narrower than its parent and no holder anywhere can widen anything.
YOU ─── sign one ceiling ───▶ MANDATE ₹6,00,000 depth 0
│
┌───────────────────┼───────────────────┐
▼ ▼ ▼
engineering design operations depth 1
₹2,00,000 ₹2,00,000 ₹2,00,000
confers · ← holds pay
cannot spend only to
│ grant it
┌────────┼────────┐
▼ ▼ ▼
workstations peripherals furniture depth 2
₹66,666 ₹66,666 ₹66,666
│
│ below the floor ─── stop splitting, act
▼
┌────────────┴────────────┐
▼ ▼
┌─────────┐ ┌──────────┐
│ PAYER │ │ LOOKER │ depth 3
│ ₹7,407 │ siblings ── │ ₹0 │
│ [pay] │ never a │ [search] │
│ │ chain │ │
└────┬────┘ └────┬─────┘
│ │
▼ ▼
┌── GATEWAY ──┐ the open web
│ signature │ supplier pages,
│ expiry │ written by whoever
│ depth │ wants the order
│ scope │
│ cum. spend │ it can read them.
│ idempotency │ it holds no money.
│ reservation │
└─────────────┘
as many layers as the budget allows · 121 nodes at depth 4 · 40 model calls
Attenuation is monotonic: a child holds a subset of its parent. Hanging the searcher below the payer would force the payer to hold search for the child to inherit it — putting “reads seller-written pages” and “can spend” in one token. Siblings are the only safe shape, and the same reasoning that separated shopper from payer.
A branch must hold everything it confers — a parent without pay cannot grant pay. So branches carry both and are refused by the gateway if they ever try to spend. That line is policy, not cryptography, and is stated here rather than discovered later. At the leaves the separation is cryptographic.
Below a per-run floor, the funnel acts rather than splitting. Budget strictly decreases at every level, so depth is bounded by log(budget / floor) regardless of the depth cap — the floor is the real terminator, and it has to be set relative to the ceiling. Left too low, every node stays “big enough to split” and nothing is ever a leaf.
Every enforcement decision, in the order it happened. Reads a running gateway when it can reach one, and says recorded when it cannot.