| The model | Obvious tricks: an email or message telling “the AI” to pay someone | Attack playground, Hide it in an email. See: the Mind lists the email under “Watch out” and does not ask to pay (stoppedBy: model) |
| Skills grant tools | A Mind without a payment skill has no payment tool, whatever it is told | Attack playground, Use a skill it doesn’t have. See: send_payment never appears (stoppedBy: no_tool) |
| The owner’s approval | Any payment the model was talked into: nothing is sent until the owner approves | Ask a Payments Mind to pay. See: an approval card that names the amount, the recipient and the checks below |
| The wallet policy (OutLayer, in a TEE) | A payment the owner approved by mistake: over the per-payment limit or to an address not on the list is refused before signing, with no transaction | Approve a payment above the limit. See: policy_denied, no tx hash. The card already says “blocked even if you approve” |
| Daily limit (OutLayer, in a TEE) | Many small payments that add up: once today’s payments reach the daily limit, the next one is refused before signing; the day starts at 00:00 UTC | Wallet → Edit → Per day. See: “Spent today: X of Y NEAR” |
| The owner’s rules (opt-in) | Nothing by themselves: they only skip the card the owner chose to skip, only up to the owner’s amount and only to a listed address. Guests and the Attack playground always ask, and the TEE policy still checks every payment | Mind settings → Approvals → payments up to 0.01. See: no card, and the receipt says “Approved by your rule” |
| Freeze (the kill switch) | Everything, at once: one transaction the owner signs | Wallet → Freeze wallet (on your own Mind). See: every later payment ends wallet_frozen |
| Unattended jobs | Autopilot jobs get no payment or approval tools; they may only email the owner or add to the owner’s calendar, as steps the owner placed | Builder → Use a tool → Email me. See: it can only send the Mind’s notes, to your own Gmail |
