{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"0e288a21-dff1-4b2e-83fb-c0fbe566cec1","kind":"skill:research-report","nodes":[{"acceptedSubmissionHash":"b564dbc839009c744781a3a9d55823c5944f0b9c97158e62d4c730489e427599","dependsOn":[],"execution":{"network":true,"profile":"none","requires":["network"],"skillHash":"3ddca93330036359dd721585e58e67820336a0398b7927b3c89369d6134f30f6","skillId":"research-report","tools":[]},"key":"research_report","kind":"code","role":"implement","skillHash":"3ddca93330036359dd721585e58e67820336a0398b7927b3c89369d6134f30f6","skillId":"research-report","state":"accepted"}],"objective":"Write a sourced report on how AI agents are given spending authority today: session keys, spending limits, allowlists and signed attestations. For each, explain what it protects against, where it fails, and which production systems use it.","parentJobId":null,"planHash":"2d73c8bfd46aaedd85b1be0ff443cdbf4fe1a8d08e3d4b14cd70fcb698efdc06","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"0e288a21-dff1-4b2e-83fb-c0fbe566cec1","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"54149","feedbackHash":"ecf81cde9a315df75eefbaa750582086c66f077b188b7919b38b10ff041a380f","nodeKey":"research_report","submissionHash":"b564dbc839009c744781a3a9d55823c5944f0b9c97158e62d4c730489e427599","tag1":"verification:structural","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"4b5d7f1a861a71fd5d8e763b4526ff567cc85528688ae36c2d957302ed3efad1","state":"completed","submissions":[{"artifacts":[{"bytes":21071,"hash":"4252ea59316df054d89ca705a66f933a1728f3cf027989dce1dc2b4eb9d19340","mediaType":"text/markdown","name":"report","path":"artifacts/report.md"}],"attempt":1,"bundleHash":"c03b8b46a30d2256e2e65eaa77c3db08cfb261ef73c04a5753048565c07c5122","device":"06d00e98fbdd1ee9","findings":[],"hash":"b564dbc839009c744781a3a9d55823c5944f0b9c97158e62d4c730489e427599","nodeId":"fa863794-d4ed-43eb-8464-614b142b2051","outcome":"completed","summary":"The report is written at `artifacts/report.md` and left untracked so it can be uploaded separately. A short `README.md` with the question and the report's limits is committed. Nobody has independently reviewed the research, and the quotes came through an automated page summariser, so they should be spot-checked before anyone relies on them.\n\n**Main findings:**\n- **The common design:** in the products I looked at, the agent gets a limited credential, not the full key or card number. Limits are enforced outside the model, by a contract, a secure enclave, the card issuer or the network. Google's AP2 spec says it directly: \"AP2 assumes that preventing prompt injection attacks is infeasible.\"\n- **The four mechanisms work together:**\n  - Session keys control who can sign and for how long (ERC-7715, MetaMask, ZeroDev).\n  - Spending limits cap the amount (Coinbase Spend Permissions and Agentic Wallet caps, the Safe Allowance module, Stripe Shared Payment Tokens).\n  - Allowlists control where money can go (Turnkey's default-deny policies, ZeroDev call policies, Stripe binding a token to one seller).\n  - Signed mandates and attestations record what the human approved (AP2 v0.2, Visa Trusted Agent Protocol, Mastercard Agent Pay).\n- **The shared weakness:** these controls cap how much damage is possible, not whether the agent buys the right thing. The Freysa prompt-injection game (about $47,000 lost) and the Princeton memory-injection study (arXiv:2503.16248) show what happens when the only protection is inside the model.\n\n**Labelling:** each claim is marked as a primary-source fact, a secondary fact, my own inference, or uncertain. Section 7 lists the open questions: who carries liability, whether these controls work in real deployments, how mature they are (ERC-7715 is a draft and Stripe's token API is a preview), and what the card networks' controls actually are.\n\n**Gaps:**\n- I couldn't fetch two primary pages (both returned HTTP 403): Mastercard's press release and Coinbase's policy-engine post. Claims based on them rely on search snippets and are marked that way.\n- There are no adoption-volume figures, because the ones I found were self-reported and contradicted each other.\n- I didn't examine Privy, Biconomy, Crossmint, Nevermined or PayPal.\n\nGit couldn't find an author identity on this machine, so I made the README commit as Jose Pena <hi@josepena.co>, set for that one command only. There are also untracked dotfiles in the repo root (`.bashrc`, `.gitconfig`, `.claude/` and others) that I didn't create; I left them alone and didn't commit them.","treeHash":"d909c24cd6bb67738e4453c0c5b9612cc49399c3","usage":{"cachedInputTokens":721190,"inputTokens":26,"model":"claude-opus-5-5","outputTokens":16021,"runtime":"claude","turns":41,"wallClockMs":217858}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"b564dbc839009c744781a3a9d55823c5944f0b9c97158e62d4c730489e427599","verifiedTreeHash":"d909c24cd6bb67738e4453c0c5b9612cc49399c3","verifierVersion":"0.1.0+8fbf00a5"}]}