Money 1.0 assumed a human at the point of every spend. Agents removed that human. So the authorization moves into policy you write and a signature only you hold. Deny by default. No spend without a decision. No decision without a record.
Give a model a payment method and its spending authority is whatever a clever input can talk it into. Wallets and agent frameworks are crowded. The scarce piece is the layer that says what may be spent, by whom, up to what, and who has to sign — as code, not as a model's judgment.
The decision states are the product. Color appears only when a decision does.
Inside policy and under the auto-tier. Executes on the rail. The agent never sees the key.
Permitted by policy, but over the line you drew. It stops and waits for your signature. The agent cannot move it.
Outside policy. Unknown payee, over cap, duplicate, wrong currency. It never touches the rail.
The agent asks to pay. It passes a payee, an amount, a memo. It holds no key and no card.
Deterministic policy evaluates against caps, allowlist, currency, and the day's spend. No model in the critical path.
Under the tier, it executes. Over it, the gate holds for a human signature. Rail keys are read only after authorization.
Every decision appends to a hash-chained ledger. Tamper-evident. One command re-verifies the whole chain.
Small, expected spend flows on policy. Real money stops at a gate only you can open. A hold emits a challenge bound to that exact payment. The only thing that releases it is an ed25519 signature over that challenge — made with a key the agents do not hold and cannot forge.
The challenge hashes payee, amount, idempotency key, and ledger position. A signature can't be replayed onto a different charge or a rewritten chain.
Checking a signature needs no secret, so the gate stays deterministic and anyone can audit a decision. Only you can make one.
Caps are evaluated again at the moment of authorization, not just at proposal. A day that rolled or spend that landed can still deny.
Every proposal, hold, authorization, and execution is a hash-chained entry. Reorder one, rewrite one, delete one, and verify reports exactly where. The audit is not a log you trust. It's a chain you check.
The Spine decides. The rail moves the money. Swap the rail without touching the policy or the ledger.
This is the gate. One primitive, deny by default, a signature only you hold.