> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hellonear.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallet, limits and approvals

> The layers that keep a Mind from paying what the owner did not allow: approval, the wallet policy in a TEE, the daily limit and Freeze.

Each layer stops an attack on its own; the ones further down do not trust the ones above.

| Layer | What it stops | Do this, see that |
| - | - | - |
| **The model** | Obvious tricks: an email or message telling "the AI" to pay someone | Attack playground, *Hide it in an email*. See: the Mind lists the email under "Watch out" and does not ask to pay (`stoppedBy: model`) |
| **Skills grant tools** | A Mind without a payment skill has no payment tool, whatever it is told | Attack playground, *Use a skill it doesn't have*. See: `send_payment` never appears (`stoppedBy: no_tool`) |
| **The owner's approval** | Any payment the model was talked into: nothing is sent until the owner approves | Ask a Payments Mind to pay. See: an approval card that names the amount, the recipient and the checks below |
| **The wallet policy (OutLayer, in a TEE)** | A payment the owner approved by mistake: over the per-payment limit or to an address not on the list is refused before signing, with no transaction | Approve a payment above the limit. See: `policy_denied`, no tx hash. The card already says "blocked even if you approve" |
| **Daily limit (OutLayer, in a TEE)** | Many small payments that add up: once today's payments reach the daily limit, the next one is refused before signing; the day starts at 00:00 UTC | Wallet → Edit → *Per day*. See: "Spent today: X of Y NEAR" |
| **The owner's rules (opt-in)** | Nothing by themselves: they only skip the card the owner chose to skip, only up to the owner's amount and only to a listed address. Guests and the Attack playground always ask, and the TEE policy still checks every payment | Mind settings → Approvals → payments up to 0.01. See: no card, and the receipt says "Approved by your rule" |
| **Freeze (the kill switch)** | Everything, at once: one transaction the owner signs | Wallet → Freeze wallet (on your own Mind). See: every later payment ends `wallet_frozen` |
| **Unattended jobs** | Autopilot jobs get no payment or approval tools; they may only email the owner or add to the owner's calendar, as steps the owner placed | Builder → Use a tool → *Email me*. See: it can only send the Mind's notes, to your own Gmail |

**Why not a capped function-call key?** NEAR function-call access keys cannot transfer NEAR, and their `allowance` is a gas budget for the key's whole life, not a spending cap ([docs](https://docs.near.org/protocol/accounts-contracts/access-keys)). The spending rules therefore live in the wallet's policy, which OutLayer checks in its TEE before every signature.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.