v0.1.0 · Apache-2.0 · arXiv:2603.24775

POCKET CHANGE

Bounded, revocable spending authority for AI agents.
The agent is assumed compromised. That is the premise, not a caveat.

7 bounds, none a model 429 tests offline 10/12 SoK vectors defended

What the system guarantees.

Eight constraints. Six hold with no model running at all; the two that need one can refuse, never authorise.

01

Budget ceiling — cryptographic

The budget lives in a Biscuit capability token signed by the root key. A block can only narrow the ceiling, never raise it. An agent that tries to spend more is refused before any network call.

token
02

Depth — derived, never claimed

depth = token.block_count() - 1. An agent that fills in its own depth is recorded as evidence, not believed. A longer chain means a narrower agent, by construction.

token
03

Cumulative spend — ledger enforced

Every payment attempt is counted against the mandate's running balance before clearing. Reservation holds the balance until the payment settles or the TTL expires.

ledger
04

Idempotency — replay safe

A unique key per payment attempt. Replays within the TTL are caught and deduplicated — a gap Razorpay's Orders API leaves open. The gateway closes it.

ledger
05

Scope — cryptographic at the leaves, policy above them

The agent that reads seller-written pages holds ("search",) and a budget of zero; the agent that pays holds ("pay",) and cannot search. Siblings, not a chain — a child would force the payer to hold search for it to inherit. Above them it is weaker and we say so: attenuation cannot express grant without use, so a branch holds everything it confers and is stopped by the gateway, not by the token.

token + policy
06

Semantic monitor — separable

An optional model call judges intent against cart contents, and all three verdicts now act: allow, defer — settle a smaller amount — and escalate to a person. Switching it off removes no cryptographic guarantee. It fails open, so exhausting a quota removes the second layer rather than blocking the first.

monitor
07

The plan is judged before authority exists

Every bound above is arithmetic, and a decomposition can divide its budget perfectly while buying the wrong things. A second model reviews each split at the one seam that matters — after the bounds, before any token is minted. It can refuse or escalate; it can never authorise. Unreachable, the run proceeds exactly as it would have without it.

critic
08

Reputation a seller cannot write

A supplier's own review count is a field it fills in. This record is written by the gateway at settlement — who was paid, and how each dealing went: refusals, escalations, human vetoes, pages that addressed our agent instead of describing goods. A tally is not a reputation, so concerns lead.

ledger

The shape.

One task becomes a tree. Every edge appends a block to the token above it, so each layer is strictly narrower than its parent and no holder anywhere can widen anything.

   YOU ─── sign one ceiling ───▶  MANDATE          ₹6,00,000   depth 0
                                     │
                 ┌───────────────────┼───────────────────┐
                 ▼                   ▼                   ▼
            engineering           design            operations    depth 1
            ₹2,00,000            ₹2,00,000          ₹2,00,000
            confers ·                                              ← holds pay
            cannot spend                                             only to
                 │                                                   grant it
        ┌────────┼────────┐
        ▼        ▼        ▼
   workstations  peripherals  furniture                          depth 2
     ₹66,666      ₹66,666      ₹66,666
                     │
                     │   below the floor ─── stop splitting, act
                     ▼
        ┌────────────┴────────────┐
        ▼                         ▼
   ┌─────────┐              ┌──────────┐
   │  PAYER  │              │  LOOKER  │                        depth 3
   │  ₹7,407 │  siblings ── │    ₹0    │
   │ [pay]   │   never a    │ [search] │
   │         │    chain     │          │
   └────┬────┘              └────┬─────┘
        │                        │
        ▼                        ▼
   ┌── GATEWAY ──┐         the open web
   │ signature   │         supplier pages,
   │ expiry      │         written by whoever
   │ depth       │         wants the order
   │ scope       │
   │ cum. spend  │         it can read them.
   │ idempotency │         it holds no money.
   │ reservation │
   └─────────────┘

   as many layers as the budget allows · 121 nodes at depth 4 · 40 model calls
          
Why the looker is a sibling, not a child

Attenuation is monotonic: a child holds a subset of its parent. Hanging the searcher below the payer would force the payer to hold search for the child to inherit it — putting “reads seller-written pages” and “can spend” in one token. Siblings are the only safe shape, and the same reasoning that separated shopper from payer.

What a branch can and cannot do

A branch must hold everything it confers — a parent without pay cannot grant pay. So branches carry both and are refused by the gateway if they ever try to spend. That line is policy, not cryptography, and is stated here rather than discovered later. At the leaves the separation is cryptographic.

The floor that terminates the tree

Below a per-run floor, the funnel acts rather than splitting. Budget strictly decreases at every level, so depth is bounded by log(budget / floor) regardless of the depth cap — the floor is the real terminator, and it has to be set relative to the ceiling. Left too low, every node stays “big enough to split” and nothing is ever a leaf.

Live vault monitor.

Every enforcement decision, in the order it happened. Reads a running gateway when it can reach one, and says recorded when it cannot.

pocketchange watch ● …