A human signs what an agent may do: which contracts, which selectors, how much per transaction, where the output may land, and until when. UNTOLL enforces that on chain at settlement, in the one place a jailbroken model cannot reach.
Off-chain policy engines, in-wallet spend caps and gateway passports all decide before the transaction. They are advisory the moment the key is out of the process that was checking it.
They fail at exactly the moment you needed them: after a leak.
UNTOLL decides at settlement, inside the contract that moves the funds. The scope is bytecode on the path the money takes, not a rule in the software that asked for it.
It holds after the key has already leaked.
A model that can be talked into anything still cannot talk a contract into paying a different address. The recipient is checked a hundred bytes into the calldata, and the transaction reverts.
The containment run gives an agent a scoped key and a real balance, then has it try to escape five different ways. Every attempt is refused on chain, and the refusal is a decode anyone can reproduce.
Every figure on this page is reproducible from the repo with one command. Run it against the deployment on Robinhood testnet 46630 and check the reverts yourself.
There is no migration. Keep the wallet SDK, the agent framework and the signer you already chose. UNTOLL sits underneath them, at the point of settlement, and the adapter is the whole integration.
Scope-native accounts map one to one. Enforce the same rule account-side and pool-side, two layers, one policy.
One action provider, and an agent acquires a bounded key and operates under it without touching your prompt logic.
A signed permission or mandate says how much and to whom. This is the on-chain, revocable enforcement of exactly that shape.
Routing to a hook-enabled pool is permissionless, so nobody has to grant access for this to work.
Five contracts, 130 tests across 18 suites. The launchpad is the first caller of this layer, not the product: it exercises the same primitive end to end, which is why it was built first. Eleven of the hook's fourteen jobs are general agent-economy infrastructure.