Gap
spend-control.ts already provides amount windows (per-request / hourly / daily / session). Those constrain how much an agent may pay. They do not constrain whom it may pay, or on which network / asset.
Agents that hold signing keys still need a way to refuse a payment before the wallet is invoked when the counterparty, network, or asset is outside policy.
Proposed addition (native to SpendControl)
Optional, default-off rules evaluated before any signer is called:
payTo allowlist / denylist- Optional network allowlist
- Optional asset allowlist
No behavior change unless one or more lists are configured. On denial: refuse with zero signer invocation (testable).
No new public lifecycle hook and no new dependencies — same ownership model as existing spend windows.
Happy to refine the shape if useful.
Gap
spend-control.tsalready provides amount windows (per-request / hourly / daily / session). Those constrain how much an agent may pay. They do not constrain whom it may pay, or on which network / asset.Agents that hold signing keys still need a way to refuse a payment before the wallet is invoked when the counterparty, network, or asset is outside policy.
Proposed addition (native to SpendControl)
Optional, default-off rules evaluated before any signer is called:
payToallowlist / denylistNo behavior change unless one or more lists are configured. On denial: refuse with zero signer invocation (testable).
No new public lifecycle hook and no new dependencies — same ownership model as existing spend windows.
Happy to refine the shape if useful.