DOCS / SPEND POLICY
Spend policy: retired. Your signature is the consent.
There is no expense account to configure any more — no allowlist to curate, no per-action or daily cap, no agent to approve before it may run. Anything that moves your money is signed by you; every paid call is receipted; and the kill switch still outranks everything.
What changed
| Control | Status | What it means for you |
|---|---|---|
| Allowlist & agent approvals | gone | Every agent in your set can run. Nothing is refused for “not approved”. |
| Per-action and daily caps | gone | No action is refused for its size. A $3 send and a $3,000 swap walk the same guard checks. |
| Policy switch, grant signing, on-chain backing | gone | Nothing to turn on, sign or back before your first ask. |
| Receipts | stay | Every paid call still lands on your dashboard with its cost and settlement. |
| Kill switch | stays | Freeze the account and everything is refused until you resume. |
Why? The caps and approvals existed to bound what an agent could spend without you in the loop. In practice they walled the first ask — a $3 send refused until you found the right toggle on the dashboard — and they never protected the thing that matters, because nothing that moves your money ever leaves the server unsigned.
Your signature is the consent
Every transaction Pantessa builds is offered to yourwallet to sign — built deterministically by the venue layer, re-verified byte for byte against what you asked for, priced on the card before you sign. If you don't sign, nothing moves. That is the control; a cap on top of it only ever got in the way.
Calls Pantessa pays for you
An x402 call paid from the house wallet — an inference engine, a data agent — is metered and receipted, never refused for policy. The receipt under each reply shows what was paid and to whom; the dashboard totals it.
Sales are not spend
Actions where your wallet receivesvalue — an NFT sale's proceeds, a filled listing — were never gated and still aren't. Only the kill switch applies regardless of direction.
The kill switch outranks everything
Two reversible stops apply to every path, in both spend directions, for self-signed and agent-initiated actions alike:
- Pause an agent (Agents tab) — freezes one key; everything else keeps working.
- Freeze the account (Overview) — refuses every payment and build under your account until you unfreeze.
When a refusal happens
A refused build names its reason — a frozen account, or a guard check the artifact failed — and the chat offers the way back (resume, ask again) rather than a dead end. Every refusal lands in your ledger next to the settlements.
Where enforcement lives
- Chats and embeds Pantessa runs — the kill switch and the guard layer are enforced server-side at the build gate and again at any submit relay.
- External SDK agentspaying from their own wallet — the open-core SDK still enforces whatever grant its operator gave it (an allowlist, caps) in-process. That is the operator's own configuration, not something Pantessa gates.