enforcement at settlement

Agents can act. The scope holds.

A human signs what an agent may do: which contracts, which selectors, how much per transaction, where the output may land, and until when. UNTOLL enforces that on chain at settlement, in the one place a jailbroken model cannot reach.

the distinction

An allowlist knows which contract was called.
It does not know where the output went.

every other layer

Off-chain policy engines, in-wallet spend caps and gateway passports all decide before the transaction. They are advisory the moment the key is out of the process that was checking it.

They fail at exactly the moment you needed them: after a leak.

this one

UNTOLL decides at settlement, inside the contract that moves the funds. The scope is bytecode on the path the money takes, not a rule in the software that asked for it.

It holds after the key has already leaked.

A model that can be talked into anything still cannot talk a contract into paying a different address. The recipient is checked a hundred bytes into the calldata, and the transaction reverts.

the proof

Five forbidden moves. Zero wei moved.

The containment run gives an agent a scoped key and a real balance, then has it try to escape five different ways. Every attempt is refused on chain, and the refusal is a decode anyone can reproduce.

  • Wrong recipient. Correct call, correct amount, output redirected. Refused on the recipient check.
  • Wrong selector. An allowed contract, a function that was never granted.
  • Over the cap. One transaction above the per-transaction ceiling.
  • After expiry. The same call that worked an hour ago.
  • Wrong target. A contract outside the scope entirely.

Every figure on this page is reproducible from the repo with one command. Run it against the deployment on Robinhood testnet 46630 and check the reverts yourself.

install

Your stack keeps working. Settlement gains a guarantee.

There is no migration. Keep the wallet SDK, the agent framework and the signer you already chose. UNTOLL sits underneath them, at the point of settlement, and the adapter is the whole integration.

wallets and signers

Scope-native accounts map one to one. Enforce the same rule account-side and pool-side, two layers, one policy.

agent frameworks

One action provider, and an agent acquires a bounded key and operates under it without touching your prompt logic.

payment standards

A signed permission or mandate says how much and to whom. This is the on-chain, revocable enforcement of exactly that shape.

Routing to a hook-enabled pool is permissionless, so nobody has to grant access for this to work.

what is true today

Deployed and source-verified on Robinhood testnet 46630.

Five contracts, 130 tests across 18 suites. The launchpad is the first caller of this layer, not the product: it exercises the same primitive end to end, which is why it was built first. Eleven of the hook's fourteen jobs are general agent-economy infrastructure.