StableOps
Get started
Agent Banking

Let agents spend. Keep the keys.

Issue every AI agent a scoped wallet bound by a mandate, spend caps, merchant allowlists, instant revoke. The agent moves money; custody never leaves you.

  • Daily, monthly, and lifetime spend caps
  • Allowlist by merchant, vendor, or address
  • Instant revoke, no quorum required

Give agents a budget, not your keys.

An agent that can move money is a liability without limits. A mandate scopes exactly what each agent may spend, where, and for how long, and you revoke it in one call. Custody never leaves your MPC root.

A hard budget per agent

Daily, monthly, and lifetime caps, per-asset or aggregate. The cap is enforced at authorization time, so an over-budget call is blocked before any money moves.

Cap window
Day · Mo · Life
Reset
00:00 UTC
Auth · p95
38ms

Only the merchants you approve

Allowlist by API endpoint, vendor, or address, domain-matched or address-matched. Anything off the list is declined and logged, with wildcards available on Enterprise.

Match
Domain · Addr
Default
Deny
Wildcards
Enterprise

Kill a mandate in one call

Revoke instantly, no quorum, no delay. The next authorization fails closed. An optional cool-down gives the agent time to bind a fresh mandate.

Revoke · p95
38ms
Quorum
None
Cool-down
24h opt
What you get

Agent banking, out of the box.

Nine controls that make an autonomous spender safe to ship. Built on the same MPC custody root.

Mandate primitive

One object scopes spend, merchants, and lifetime. Versioned and revocable.

Spend caps

Daily, monthly, lifetime limits enforced at authorization time.

Merchant allowlists

Domain or address matched. Default-deny, with logged declines.

Instant revoke

One call kills a mandate. No quorum, optional cool-down.

Synchronous decisioning

Approve or block per call, median 38ms, your policy in the path.

Per-call audit log

Every authorization is a signed row with the mandate version.

Custody stays with you

Agents never hold keys. Signing runs through your MPC 2-of-3 root.

Cards for agents

Issue a virtual card per agent; the mandate gates each authorization.

Screening on every spend

Merchant and counterparty screened against OFAC, EU, and UN lists.

Lifecycle

Issue to revoke, on one ledger.

Every agent follows the same path. You wire the mandate once and reuse it for every spender.

01
Issue

Create a mandate that scopes caps, merchants, and lifetime.

mandate.created
02
Authorize

Each call checks cap, merchant, mandate, and signature. 38ms.

auth.requested
03
Spend

Approved spend settles from the agent wallet, gasless.

transfer.outbound
04
Audit

Every decision logged with the mandate version and policy.

audit.exported
05
Scope

Tighten caps or allowlists in place, no re-issue.

mandate.scoped
06
Revoke

Kill the mandate instantly. Next call fails closed.

mandate.revoked
FAQ

Questions builders ask first.

Still unsure? Talk to a solutions engineer, no sales script.

Does the agent ever hold private keys?
No. The agent holds a mandate, not a key. Signing always runs through your MPC 2-of-3 root, so a compromised agent cannot move funds beyond its scope.
What happens when an agent exceeds its cap?
The authorization is blocked before any money moves, and the attempt is logged. The agent receives a decline; you see it in the audit trail in real time.
How fast is an authorization?
Median 38ms end to end: cap check, merchant match, mandate validity, and signature, all in the path before the call returns.
Can I revoke without involving signers?
Yes. Revoke is a single call with no quorum and no delay. The next authorization fails closed; an optional 24h cool-down lets the agent bind a replacement.
What does it cost?
8¢ per operation, all-in. Mandates, authorizations, allowlists, and the audit log are included.

Ready to get started? Issue an agent wallet, or pick a plan and ship.

Have more questions?
Talk to a solutions engineer, or read the docs.