DOCS /SPEND POLICY & CAPS
Spend policy: open by default, capped by default
Your expense account draws one line: what may agents spend without you in the loop. It starts open — every service enabled, protected by $200 caps — and you curate it down, not up. What you sign yourself is consented by that signature; what you receive is never gated; and the kill switch outranks all of it.
The defaults
Your expense account is created on your first dashboard visit, already on and already protective:
| Setting | Default | What it does |
|---|---|---|
| Allowlist | everything (*) | All directory services enabled out of the gate — newly listed MCPs work without a re-sync. The caps are the protection, not the list. |
| Per-action cap | $200 | An agent-initiated action above this is refused. |
| Daily cap | $200 | Agent-initiated spend past this in a UTC day is refused. |
| Policy switch | on | The allowlist and caps are enforced from the first call. |
Why open? The old model — everything off until approved — walled brand-new accounts at their very first ask. Open-with-caps means your first swap works and a runaway agent still can't drain anything: the caps bound what moves without you.
Curate down, not up
The first agent you toggle off in Approvals starts curation: the open wildcard is replaced by a concrete list — every service you have not disabled. Two things always stay allowed on a curated list, because cutting them off breaks the product rather than protecting you:
- Pantessa's native venues (the Uniswap/LiFi/CoW/Aave/Hyperliquid/ OpenSea build layers) — you sign every one of those transactions yourself.
- House inference — the model that answers your chat turns.
Your signature is the consent
The caps exist to bound what agents do without you. A transaction your own wallet signs — a swap you asked for and approved in your wallet — is not refused by the per-action or daily cap: the signature is the consent. The allowlist and the kill switches still apply to self-signed builds; only the caps step aside.
Sales are not spend
Actions where your wallet receives value — an NFT sale's proceeds, a filled listing — are never gated by caps or the allowlist. Those controls govern what may be paid out, and gating a $1,800 sale behind a $200 spend cap protects no one. Only the kill switches apply regardless of direction.
The master switch
One switch on your dashboard Overview arms the whole policy. On (the default), the allowlist and caps are enforced and every refusal is ledgered. Off, agent spend is unrestricted — still metered and receipted, just not refused. Toggling it never touches your per-agent approvals: flip it off for an experiment and back on, and your curated list is exactly where you left it.
The kill switch outranks everything
Two reversible stops work even when the policy switch is off, in both spend directions, for self-signed and agent-initiated actions alike:
- Pause an agent (Agents tab) — freezes one key; everything else keeps working.
- Freeze the account (Overview) — refuses every payment and build under your account until you unfreeze.
When a refusal happens
A blocked build tells you which rule refused it and what to change — over the per-action cap, over the daily budget, or a host outside your curated allowlist — and the chat offers the fix (allow this venue, retry the job) rather than a dead end. Every refusal lands in your ledger next to the settlements; an audit trail that only shows successes isn't one.
Where enforcement lives
- Chats and embeds Pantessa runs — enforced server-side at the build gate and again at any submit relay. Instant and hard.
- External SDK agentspaying from their own wallet — enforced by the SDK's grant in-process, refreshed from
GET /api/agent/policy. Pantessa cannot intercept another wallet's transfer in flight; the hard on-chain stop for adversarial cases is what Coinbase Spend Permissions add.