Small things run. Big things ask. Every spend, a receipt.
Grok Bot’s wallet is all-or-nothing: nag you on every action, or hand over the keys. AskGrokWallet is the layer in between for a whole fleet of bots — one policy, per-agent budgets, over-the-line asks, and a signed receipt on every action.
“Under $50 runs. Over $50 ask me. Never pay blacklisted merchants. Daily budget $200.” The engine compiles it — no hooks, no config files.
2
The engine decides: allow / ask / deny
Every agent request is checked against the policy. In-budget runs instantly, out-of-bounds is held, blacklisted is refused — and you see exactly which rule fired.
3
You approve. It signs a receipt.
Anything that needs a human hits your inbox — one tap on your phone. Every action leaves a signed receipt: which bot, what, which rule, who approved.
Connect a real agent — in one call
Your bot asks before it spends. You answer once. It keeps a receipt.
Meet Atlas — a bot that pays your SaaS bills and API invoices. Instead of handing it a card, you give it one line: before any spend, POST the request here. Under the line it runs on its own; over the line it waits for one tap. Either way you get a signed receipt.
{
"ok": true,
"verdict": { "verdict": "ask",
"reasons": ["$80 is over the $50 line"] },
"approval": {
"id": "appr_9c1f2ab04e7",
"status": "pending",
"requester": "atlas"
}
}
ask → lands in your console for one tap. allow → runs instantly, receipt logged. deny → refused before the money moves.
🔒
Why the “deny” actually holds: Atlas doesn’t hold your card — it spends from a bounded on-chain allowance. Over-budget or off-allowlist never gets signed, so it’s blocked before the money moves — not flagged after. That’s the part a plain card can’t do.
⚡
Running on Grok? Skip the curl.
Install the grokbotwallet skill and your bot calls this gate on every spend automatically — no code. Honest note: this is opt-in. It governs spend that routes through the gate; a raw card you hand the bot we can only flag, not block.
The budget, policy, receipts and attribution Grok doesn’t ship.
◈
Per-agent spend caps
Single-tx, daily, and monthly limits per bot — the cap Grok Bot doesn’t ship.
❝
Plain-English policy
Write rules like a sentence. The compiler turns them into allow / ask / deny.
🧾
Signed receipts
Every spend produces a receipt: agent, request, rule hit, approver, time.
◎
Attribution & audit
Every bot has its own budget and log. No more “which bot spent this?”
🔒
Funded, never the keys
Agents never hold your card or keys — only a bounded allowance. Over-budget is blocked before it runs.
▤
Batch approvals
Draft-heavy bots queue work; you approve or reject the whole batch in one pass.
What we can actually stop
If it runs through the gate, we hold it. If not, we can only flag it.
The honest line most tools blur: real enforcement needs us on the payment rail. On-chain spend (x402 / stablecoin) runs from a bounded allowance, so we block it before it happens. A credit card the agent already holds settles on the card networks — we can only log it after the fact.
Enforced — held before it happens
✓
On-chain payments (x402 / stablecoin)Live
The agent spends from a bounded on-chain allowance — over-budget or off-allowlist never gets signed. This is the rail we actually sit on.
✓
Agent-to-service API paymentsLive
Pay-per-call over x402 runs through the gate; anything out of policy is refused before it settles.
✓
Send a message (Slack / X)Roadmap
When the send is routed through us as a tool call, an over-the-line post is held for one tap.
✓
Send or delete emailRoadmap
Gated as a routed action — a deletion or blast waits for you.
✓
Delete or move filesRoadmap
When the destructive call routes through the gate, it’s the checkpoint — not an afterthought.
Flagged — logged & alerted, not blocked
▲
Any credit / debit / virtual card
Card spend settles on the card networks, merchant-initiated — it never routes through us. We log it and alert you, but we structurally cannot decline the charge. This isn’t a roadmap gap; it’s how cards work.
▲
Any raw key the agent already holds
If it can sign or spend without asking us, we’re not the fence — we’re the camera. Give it a bounded allowance instead.
The fix: don’t hand an agent a card or a raw key. Fund a bounded on-chain allowance and route its spend through the gate — then every action is enforced, not just observed.
What a receipt looks like
askgrokwallet · receiptAPPROVED
agentAtlas
requestPay OpenAI API invoice
amountUsd$80.00
ruleHitover $50 → ask me
decisionapproved
approvedByyou@demo
requestIdappr_9c1f2ab04e7
signed✓ signed & stored
This week’s receipts
0
requests
0
auto-allowed
0
asked
0
denied
$0
blocked
One number a week, forwardable in one screenshot: 42 requests · 31 auto · 9 asked · 2 denied ($1,240 blocked).
Give your bots a wallet with rules.
Watch a request get allowed, asked, and denied — then read the receipt. No signup.