Hard, on-chain spending limits. The agent can only do what the account allows, not what the prompt says.
gone in one message. A Morse-code prompt tricked Grok into emitting a transfer, and a bot executed it on-chain.
This is why banks won't let an agent near real money.
Guardrails stop at the address.
No dollar ceiling.
Allowlists and on/off modes.
No hard cap.
One jailbreak
drains the whole wallet.
An intern gets a $500 card. Agents get the vault.
The limit lives in the smart wallet,
not the prompt.
Caps, allowlists, expiry on ERC-4337. Exceed the mandate and the contract reverts it.
Below the model. The chain rejects out-of-scope actions even if the agent or our servers are compromised.
A jailbreak changes what the model says, not what the account allows.
Every dollar an agent moves needs a mandate.
| Player | Enforcement location | Dollar caps | Vendor-neutral |
|---|---|---|---|
| Coinbase Agentic Wallets | Off-chain (enclave, in custody) | Yes | No |
| Privy (Stripe) | Off-chain (signing service) | Partial | No |
| Turnkey | Off-chain (enclave policy) | Partial | No |
| ZeroDev | On-chain primitive | Raw primitive | Yes |
| Botanary | On-chain (contract reverts) | $ / daily / per-job | Any ERC-4337 |
Coinbase caps inside its own custody. Ours is enforcement no custodian owns.
| Free · Build & Pilot500 wallets · 10K checks/mo · $50K protected/mo | $0 |
| Growthvs Privy Core $299 | $269/mo |
| Scalevs Privy Scale $499 | $449/mo |
| Enterprisechecks as low as $0.00135 · vs Turnkey floor $0.0015 | Custom |
| Core engine · protected-volume feeon protected fund-transfer principal, capped ~$25/job · a category no incumbent prices | 0.10% (10 bps) |
Revenue scales with value protected, not idle wallets. Software-like margins.
Every item ≤30 days old.
Pre-revenue — and we say so.
Institutions don't ask how smart the agent is. They ask what's the worst it can do. The answer is an account, not a prompt.