LIVE ON BASE MAINNET · ERC-8196 · MIT

Your AI can do the work.
It should still follow your rules.

Small things run on their own. Big things ask you first. Every action leaves a record.

under the limit → runs over the limit → asks you blocklisted → always denied every action → on-chain record
30-second demo Read the code
01 · The problem

AI acts fast. It has no sense of "should I?"

It isn't malicious. It just has no boundaries — and today's tools ship without any.

😵 40 refunds issued, 3 to fraudsters

You asked it to handle customer refunds. It processed 40 in one pass. The money is gone.

🗑️ 90,000 "junk" emails deleted, including your contract

You asked it to clean up your inbox. It also removed the contract you sign next month.

Option A: hand over everythingGive the AI your wallet and your permissions, and hope.
Option B: approve every stepConfirm everything manually, until nobody wants to use it.
There is a third option: set the rules first → the AI runs freely inside them → when it steps outside, it asks you.
02 · How it works

Like issuing a company card to an AI employee

Funds on the card, rules on the card. Every action it wants to take goes through this gate.

🤖 The AI wants to do something
send a payment · delete a batch of email · post an external message
🚪 Policy gate
your rules: ask me above $50 · auto-approve below · blocklist always denied
small
✅ runs
$12 API bill, no interruption
over the line
📱 asks you
$400 refund, waits for one tap
blocklisted
🛑 denied
rejected by the contract, no prompt
🧾 Record (hash-chained on-chain)
which agent · which rule it hit · who approved · where the funds went · what happened
agent refund-bot-01
action transfer $420.00 → merchant_8821
rule hit
approved yanqing · 2026-08-30 13:42:07
receipt 0x7f3a…c19d ✓ audit chain intact
The on-chain audit trail is hash-chained: each entry commits to the previous one, so anyone reading the event log can recompute it, and altering one entry breaks the chain. The off-chain receipt above is tamper-evident, not third-party verifiable — see known gaps.
03 · Vs. spending caps

A spending cap stops at the moment of payment

Cloudflare (2026-08-04) gave agents wallets with preset limits; Stripe issues single-use cards. Caps and human approval are table stakes now — MetaMask Agent Wallet shipped both in August. What still isn't solved is everything that isn't a payment, and proving after the fact which agent did what under which rule.

Capability Preset caps
Cloudflare / Stripe		 AskGrokWallet
Set a spending limit up front✓✓
Ask a human when the limit is crossed✗✓
Rules enforced by the contract, not by a signer✗✓
Covers deletes and sends, not just payments✗✓
Afterwards, prove which agent did it✗✓
We are not competing on the first row. The other four are the point.
04 · One engine

Not two product lines — one rule set, several interfaces

Because the unit we govern is not money, it's actions. Paying is one kind of action.

Boundless engine
policy + approval + record — one implementation, always consistent
💸
Payments
✅ done · Base mainnet
📧
Email
🔨 in progress · approve before send/delete
📁
Files
⏳ later · approve before delete
What we deliberately do not do: connect to your bank or your credit card with raw credentials. The practical reason: bank fraud models treat "a bot logging in from a datacenter IP" as exactly that, and you end up explaining to a teller why you botted your own account.
05 · Proof

Not a deck. The code is running on mainnet.

ERC-8196 (AI Agent Authenticated Wallet) moved to Final in July 2026 — and shipped without a reference implementation or test cases. We implemented it and deployed it. The agent holds a scoped, capped authorization, never your private key.

19/19
contract tests passing
Base
mainnet deployed
8196
ERC implemented
MIT
open source
TrustLeaseController (policy enforcement)0x4ACcB1df8cc625AC05743888158CC3B866aC9833
BoundlessVault (custody)0xd9526Eb615f5e252341b5a83b3c26eCca4f1284e
VerificationScoreRegistry (risk scores)0x89c8B3d053a79A0bd5A47597aaF97729f504d359

🔐 No key access

The agent holds a capped lease, not a key. Over the cap, the contract reverts — we cannot move your funds either.

⛓️ Records can't be edited

Each entry commits to the previous one. Change one and the chain no longer verifies — including for us.

🚫 Revocable any time

If one agent misbehaves, revoke that one lease without stopping the rest of the fleet.

Being straight about the current gaps: an approved request does not yet execute itself, off-chain receipts are HMAC rather than public-key signed, and the risk oracle is still a mock. All four are listed here.
06 · What we want

Real users first. No token.

We are not doing the launch-a-concept-then-a-token thing. Trust is the whole product here, and trust only accumulates through real use. What we want right now is not money — it's 50 people willing to try this and tell us where it hurts.

30-second demo Approval console GitHub