A scoped, revocable session key that a Uniswap v4 hook enforces at settlement: one recipient, one selector, a per-transaction cap, an expiry. Jailbreak the agent and every out-of-scope call reverts on-chain. The limit is in the chain, not in the model.
Live and source-verified on Robinhood Chain testnet. 130 tests. One command to check it yourself.
Every pitch for an agent that can spend money ships with the same hidden asterisk: you have to watch it.
Hand a program a wallet and you have not delegated anything. You have taken a second job: babysitting it. Watching the balance, revoking access the moment it acts strange, hoping the model does not get talked into moving your money somewhere it should not go. The industry calls this progress. It is a leash you hold in your own hand, and it does not scale past the first agent you stop trusting.
UNTOLL deletes the asterisk. Not by making the agent smarter or the model harder to fool. By putting the limit somewhere the agent cannot reach: below it, on the chain, at the moment money actually moves.
The value here is not that your agent is guarded. It is what you get to stop doing. Give an autonomous agent a real budget and real authority, then close the laptop and go do whatever you want. It keeps working. You stop watching. That is the whole promise, and everything technical below exists only to make it true.
Hand your agent real money. Then go do whatever you want.
The person delegating the work is the one who wins here, and what they win back is their attention. An agent you have to supervise is a coworker who needs approval on every line item. An agent on a scoped key is a coworker you can actually hand a card to, because the card only works the way you said it could.
The agent holds a scoped, revocable session key that the contract enforces at settlement: one action, one recipient, a per-transaction cap, an expiry. Jailbreak the agent, phish it, feed it a poisoned instruction, and in the demo every attempt to move money out of scope hard-stops on-chain. The enforcement lives in the contract, not in the model, so compromising the agent's reasoning does not, by itself, move the money.
And this is not a slogan. It is a line you check on-chain, not a promise you take on faith. Below is what a jailbroken agent on a scoped key actually does when you run it: five drains, five reverts, and the one allowed call settles.
Agents can already pay. The agent-payment standards ship, the rails settle, the money can move. What has not existed is the layer beneath them that makes an agent's authority enforceable, so the money moves only the way its owner allowed. That layer is this.
An agent is not useful with money until it is safe to leave alone. UNTOLL is where that becomes true.
Until now the choices were all versions of giving the delegation back:
Each of those buys back a little comfort by handing the delegation away. UNTOLL does not make the trade. You keep the full delegation, and the enforcement lives below the agent, in the contract rather than in the model it runs on. That is a category, not a feature: not agent security among many tools, but the thing that makes a hands-off agent possible at all.
The hook and the enforcement layer are open source and deployed, source-verified, on Robinhood Chain testnet, where the canonical Uniswap v4 PoolManager runs at the same address as mainnet. 130 tests pass on a cleared cache. An independent third-party review is the gate to mainnet. Everything on this page is something you can go check, which is the point: the credibility is in the running of it, not the reading of it.