The agent never holds a private key. It holds a tab: a funded USDC balance on Base wrapped in limits you set. Everything pahz refuses, it refuses because of the tab.
The tab can spend what it holds and nothing more. Top-ups are a signed action by you.
budget: 5.00 USDC
A loop that calls the same endpoint 400 times hits the cap long before the budget.
rate: 60/min · 1000/h
By host, or by a directory tag like verified:search. Unknown services are held.
allow: [search.api, infer.llm,
prices.feed, tag:verified]A service that raises its price gets held until you agree.
band: {infer.llm: 0.02,
"*": 0.005}One signature pauses all payments. The agent keeps running and receives structured refusals.
pahz tab close 4127
Optional. After expiry the balance returns to you automatically.
expires: 7d
The tab lives in two places. On Base: a small contract holding the USDC, with budget and allowlist encoded; settlements that violate them revert. In the pahz signer: rate caps and price bands, checked before any authorization is signed.
The agent's fetch wrapper talks to the signer; it never sees a key. A compromised agent can at most spend the tab, within its rules, until you close the tap.
Every payment is a line: service, endpoint, price, latency, nonce, settlement id. Every held call is a line too, with the rule that held it. The meter is readable live, exportable as CSV, and reconciles to settlement receipts on Base.
For fleets, meters roll up: per agent, per team, per service. "What did we spend on inference this week, across all agents" is one query.