Your agent can run. Your API bill can't.
Set a hard limit before the next model call leaves your stack. Sanction authorizes AI spend, MCP tools, and x402 payment demands before they become irreversible.
AGENT WALLET LIVERunaway spend is not an observability problem.
The agent kept retrying
It kept reading, checking, and repairing after it passed the number you had in your head. Your provider kept accepting calls. Your card kept paying.
The alert arrived after the spend
Usage dashboards explain what happened. They do not decide whether the next call is allowed to leave your stack.
The action could not be taken back
A destructive tool call or signed machine payment needs authorization before execution, not a report after it clears.
Start with the most expensive failure mode.
One decision engine sits in front of three irreversible actions. Sanction authorizes the spend; any rail settles it.
Govern MCP tools before they run
Put the hosted broker in front of an MCP server. Block destructive tools, escalate sensitive ones, and return a machine-readable refusal before the upstream receives the call.
Cap AI spend by team
Change the model gateway base URL. Wallet-tree budgets enforce agent, team, and organization caps without instrumenting every call.
Authorize x402 before the wallet signs
Send the payment challenge to Sanction first. It prices the worst case, applies policy, and withholds a denied demand before the wallet can sign it.
Put policy in the path, not beside it.
Connect one enforcement point
Use the LLM gateway, the hosted MCP broker, or the pre-sign quote endpoint. Your provider, tools, and payment rail stay yours.
Set the policy
Define agent and team budgets, allowed or blocked tools, escalation bands, and the hard line that cannot be crossed.
Get a deterministic decision
Approved proceeds. Escalated pauses for a human and a one-use grant. Denied stops the provider call, tool call, or wallet action.
Export the evidence
Every decision is attributable and exportable in a signed, hash-chained record for engineering, finance, and audit.
Policy travels with the agent.
Identity says who the agent is. Payment rails move money. Sanction carries the missing authority: what the agent may spend or invoke, under whose policy, within what budget, and with what proof.
Discover
A counterparty finds the issuer and verification surface.
Present
The agent carries a signed, scoped, time-bound mandate.
Verify
The counterparty checks budget, scope, freeze, and revocation.
Prove
Each authorization becomes attributable evidence.
$ npx sanction-mcp✓ wallet connected ops_agent_07✓ 10 governance tools available→ sanction_authorize_toolAUTHORIZED · request dec_8f31Put policy in front of every tools/call.
Register an upstream once, then point the MCP host at Sanction's broker. Every tool call is authorized before a byte reaches the upstream, and the upstream credential stays in the vault.
Brokered traffic is enforced. Calls sent directly to the upstream bypass Sanction and are not governed.
What Sanction does not do.
Sanction does not settle payments. It authorizes the spend; any rail settles it.
Sanction does not replace your model provider or MCP server. It governs whether the next request may reach them.
Sanction does not custody signing keys. In the broker, a denied x402 challenge is withheld before your wallet sees payment instructions.
Sanction cannot govern traffic routed around it. Enforcement applies at the gateway, broker, and authorization endpoints you connect.