Product
Spending guardrails your agent physically cannot break.
Agents are getting wallets. Today you either hand one a private key and hope, or you sign everything yourself and lose the point of autonomy. AgentPact is the third option: the agent gets authority, the authority has a shape, and the shape is enforced outside the agent.
The Pact
One document defines the agent's financial authority.
A Pact is written by the owner and versioned append-only. It sets the per-transaction cap, the daily budget, allow / ask / deny per action type, allowed assets, trusted and blocked destinations, velocity limits, and when a human has to say yes. The agent cannot read its Pact and negotiate; rules run in a fixed order with no AI in the loop.
Budgets
Per-transaction cap, rolling 24h daily limit, per-session-key budgets. Exceeding the day is a hard deny, never a question.
Permissions
Payments, swaps, transfers, contract calls: each allowed, denied, or escalated to the owner.
Destinations
Trusted lists, blocked lists, and a server-side memory of who the agent has paid before. First payment to a stranger can require approval.
Versions
Every edit is a new immutable version. Every decision records which version judged it.
Enforcement
A denied transaction is never signed.
Most agent-safety tooling is advisory: the agent is told no and can ignore it, because it still holds the key. AgentPact closes that hole with the Vault.
The Vault
Each agent's funds live in a Vault it can never open alone: the key is held server-side, and only an ALLOW gets signed and broadcast on Robinhood Chain. The agent holds nothing but a revocable session key.
Advisory mode
Agents holding their own keys still get the full decision pipeline through /authorize - useful for monitoring and audit, without custody.
Atomic budgets
The allow is committed in one atomic write, so concurrent requests can never overspend the same remaining budget.
On-chain receipts
Executed payments store their transaction hash on the decision, verifiable on Robinhood Chain.
Owner controls
The agent works. You keep the keys.
Your wallet is the root authority. An agent cannot raise its own budget, edit its own Pact, approve itself, or extend its own session.
Approvals
Mid-sized and unusual actions wait for you in the dashboard. Approvals expire on their own and are re-checked against the budget at the moment you approve.
Freeze
One click revokes every session key and denies everything new. Unfreezing never resurrects old keys.
Audit trail
Every decision stores the Pact version, session key, rule checks, reasons, and the tx hash when funds moved.
Session keys
Scoped, time-boxed, hashed at rest, revocable one by one.
Integration
MCP for agents. SDK and REST for everything else.
Claude, Codex, and any MCP client connect to mcp.agentpact.dev with the agent's session key. Custom agents use the TypeScript SDK (@agentpact-dev/sdk) or plain REST. The policy engine lives server-side either way; the clients hold no rules.
MCP tools
pact_authorize, pact_pay, pact_budget, pact_wallet, pact_activity, pact_approval_status.
Sandbox
One curl creates a throwaway agent with a real Pact - no signup, nothing to install.
TypeScript SDK
authorize / pay / budget / activity / waitForApproval with full types.
REST
Everything above is a plain HTTP API if you want it raw.