System
The reserve holds the capital. The other six say when an agent may spend, where it may send funds, how much, and under whose supervision. Each one is optional. Each one is checked by the contract in the same call that moves the money.
One vault. No private key. Every move bound by code.
The reserve is a single contract. It is a custody account that nobody can sign for directly, including you. Capital leaves it only when the program says a rule was satisfied, and the rules are stored on the chain next to the money. Everything else in the system is grammar around this one object.
Every agent gets its own ledger.
A lane is a sub-account inside the reserve. It holds a balance, counts its transactions, and carries its own set of constraints. One lane is bound to one agent wallet, and that wallet is the only address allowed to spend from it. Lanes cannot reach each other. If an agent is compromised, the blast radius is the lane you gave it.
A ceiling per transaction. A rolling daily cap. Both atomic.
Every payment is measured against the lane caps inside the same call that would move the funds. The daily window rolls on the chain clock, not on a cron job. Break one rule and the whole transaction reverts. There is no partial spend, no queue that drains later, and no race between a check and a transfer.
An allowlist on-chain. Everything else is rejected.
Each lane keeps its own list of approved recipients, every entry tagged with a label you can read later. The contract checks the destination before it signs anything. An agent that has been talked into paying a new address by a prompt, a poisoned response, or its own bad judgement simply cannot. Only the authority edits the roster.
Draw the window. The chain keeps the time.
Define a daily window in UTC and payments outside it revert. The window may wrap midnight. The source of truth is the block timestamp, so a drifting server clock, a paused container, or a restarted agent changes nothing about when money is allowed to move.
Lanes that refill before they run dry.
Set a floor and a target on a lane. When the balance falls under the floor, anyone can call the crank, and only the contract can move the funds, up to the target and no further. It removes the standing job that watches balances and the operator who has to be awake for it. Ships with contract v2.
Above a number you pick, one signature is not enough.
Payments over a threshold become proposals stored on-chain. Signers approve, and once the threshold is met anyone may execute. Proposals expire. The signer set lives in the contract rather than in a database, so the rule survives whatever happens to your infrastructure. Ships with contract v2.
There is no plan to pick. You choose a posture and compose the parts: strict or open, narrow or wide. Each lane gets its own constitution, each one can be amended, and the chain keeps every version.