An agent that cannot overspend.
An AI-agent delegation can carry a metered spend cap, enforced live — a key-bound, attenuating delegation chain, with the cap decided at action time, not advisory.
Delegation that attenuates.
A key-bound, attenuating delegation chain — principal → team-lead → worker — issues the worker a tighter cap (€40) than its parent (€100). Each sub-delegation is cryptographically signed by its parent: attenuating, accountable.
Two attempts. One gets through.
Two metered purchase.execute attempts of €30 each are decided in front of you: the first is authorized (€30 ≤ €40), the second is denied cap_exceeded (running total €60 > €40) — enforced at action time, not advisory. Every attempt, authorized and denied, is recorded in an auditor-only sealed audit record.
Runs against this deployment's live GET /agent/chain/demo — the chain is issued fresh, with demo-issued ephemeral keys, on every run.
The same rail, applied to agents.
This is not a separate product — it is the delegation and audit machinery from the rest of the rail, applied to the newest holder of authority: software agents. The question an agent raises is the old one, sharpened: who allowed this, how much, and can you prove the denial as well as the approval?
What this is — and what it is not
01A contested market, said plainly+
Agent authorization is a crowded, fast-moving space, and we do not claim to be alone in it or ahead of it. What this page shows is our specific mechanism: a key-bound, attenuating chain with a metered cap that is enforced at action time — and a denial that is recorded, not just an approval.
02What is real in the demo+
Cap enforcement is real: each sub-delegation is cryptographically signed by its parent, the €40 cap is checked when the action runs — enforced at action time, not advisory — and the second €30 attempt is denied cap_exceeded. Every attempt, authorized and denied, is recorded in an auditor-only sealed audit record.
03What is demo-grade+
The credentials are demo-issued with ephemeral keys, minted fresh on every run — reference-grade, not a production credential lifecycle. PSDP is a reference implementation; production hardening is in progress.
04What we do not claim+
No claim that this is production-ready, certified, or adopted by any wallet, platform, or standards body. No claim about the agent's intelligence — the reasoning that decides what to buy is the caller's; this rail decides whether it may, and keeps the receipt either way.