How it works
The agent decides and acts alone. The vault is what keeps that safe.
A wallet you control funds the vault and sets a per-payment cap, a daily cap, the payees the agent may pay, and a pause switch.
It reads what is owed, checks the vault's real balance, the due date and a reserve floor, and decides to pay, wait, or hold.
Inside the rules, one transaction creates and releases a mandate on MandateEscrow. Outside them, the vault refuses and the agent logs why.
Every payment, mandate and balance is read straight from Arc, with a link to the explorer. Nothing is taken on trust.
Why a blockchain, and why Arc
A normal payments API needs a human, or a trusted middleman, to authorize every transfer. An agent that decides and acts on its own, on a schedule, with no one watching, needs something else: money that lives somewhere it can prove it controls without a password handed to it each time, and a permanent record of every decision, so a wrong payment is provable rather than a "trust us" in a database.
Arc is built for exactly this. Gas is paid in USDC, the same money moving through the system, rather than a separate token to keep topped up, and settlement finishes in under a second, so checking a balance every few minutes does not cost more than the payments themselves.
Bounded autonomy
The vault turns an unbounded risk into a number you chose. Here is the honest version of every way it can go wrong.
If this leaks
An attacker can
Spend as the operator, and nothing else.
What limits it
The per-payment cap, the daily cap and the payee allowlist bound every call. It cannot withdraw. The owner pauses the vault or replaces the operator at once.
If this leaks
An attacker can
Everything in the vault.
What limits it
Only the owner's own key hygiene: a hardware wallet or a multisig, and a small balance. This is why the owner is never a key in a config file.
If this breaks
An attacker can
Lose up to the vault balance.
What limits it
Fuzz and mutation-tested code, a verified source anyone can read, a small balance, and the plain statement that it is not professionally audited.
What it does not do
A compromised agent can still spend up to the caps on payees the rules allow. The guarantee is a bounded worst case that the owner picked, not good judgement. That is why the caps are small, the allowlist is on, and the vault is meant to hold a modest balance.
Under the hood
Built directly against Circle's primitives and Arc's contracts, not a starter kit, since the loop itself is the product.
The agent signs from a real Circle-custodied wallet, Live environment, that holds only gas. No private key lives in this codebase, and the wallet holds nothing worth stealing.
The treasury lives in a contract. The owner sets the caps, the allowlist and the pause switch; the agent can only pay inside them and can never withdraw.
Every payment is its own mandate on a permissionless contract: fund it, prove fulfillment, release atomically, with a reputation ledger that updates on-chain.
Before acting on a foreign-currency bill, the agent pays a sub-cent fee to a rate oracle for the live exchange rate. A real, working micropayment.
The agent can bridge USDC in from another chain when the vault runs low. Proven on testnet; disabled on mainnet until a funded source wallet exists.
Circle confirms each transaction with a signed webhook, verified before an obligation is marked settled, so the record follows the chain and not the other way round.
Build on it
MandateEscrow has no owner, no allowlist and no fee. Use it from a browser wallet, from code, or hand it to an AI agent as tools.
const agent = VaultClient.fromPrivateKey(key, {
vaultAddress: "0x8B4e…27B5",
});
// Ask first: no gas, and it says exactly why not.
const check = await agent.checkPay({
to: vendor, amountUsdc: "0.5",
});
// One atomic transaction, inside the owner's rules.
await agent.pay({ to: vendor, amountUsdc: "0.5" });{ "env": {
"MANDATE_VAULT_ADDRESS": "0x8B4e…27B5",
"MANDATE_PRIVATE_KEY": "operator key, gas only",
"MANDATE_ENABLE_WRITES": "true"
} }# No wallet, no login. Reads live from Arc mainnet.cast call 0x8B4e7F295Ed70DA321831bA34cd0C84443C427B5 "availableNow()(uint256)" \ --rpc-url https://rpc.mainnet.arc.io # Every mandate ever created on the open primitive:cast call 0xca901f58fb82FE5FF459264a419b8cF8c75b3371 "nextMandateId()(uint256)" \ --rpc-url https://rpc.mainnet.arc.io