Overview and Problem

Overview and Problem

The problem

AI agents are getting wallets. A budget written into a prompt is not a control. An agent with raw account access can overspend, pay the wrong merchant, or ignore a stop. What is missing is an authority layer that decides what an agent may spend, on whose terms, with a record.

Permit's answer

• The agent never holds PayPal credentials. It calls tools. The tools call the spend pipeline. The pipeline asks the gate.
• Each agent spends on a permit: cap_cents, allowlist, expiry, revoked.
• Money moves in two steps. First a PayPal AUTHORIZE hold, then a capture that happens only when delivery evidence passes a predicate.
• Every attempt is written to a tamper-evident claim ledger.
• A human keeps the brakes: e-stop and cascade revoke, approval thresholds, and tighten-only narrowing.

What is implemented (code at 9900817)

Capability	Where
Four-clause gate + positive-integer amount guard	permit/permit.py
Spend pipeline (check → reserve → hold → escrow → capture)	permit/flow.py
Release-verifier: the only capture path, UNKNOWN and reconcile	settlement/verifier.py
Mock PayPal rail (default)	settlement/paypal_client.py
Real PayPal sandbox REST client (CAD, merchant binding)	settlement/sandbox_client.py
Delegation, cascade revoke, tighten, approvals	permit/permit.py, permit/flow.py
JSON HTTP service	server.py
Live dashboard (state, e-stop, revoke-cascade, cap tighten, approvals)	dashboard/
LLM agent spender	agent/

Actors

Actor	Role
Payer	Approves each sandbox order in a browser
Merchant	Delivers. Delivery evidence releases the hold
Permit operator / principal	Issues permits, approves big spends, holds the e-stop
Credential owner	Holds the PayPal secret. The agent never does
Agent	Decides what to attempt. Has no other way to move money

See also: Production Boundaries.