What can it hold or move?
Enumerate the exact assets and networks permitted — an agent that can technically reach any token on any chain has no asset scope, regardless of what its instructions say.
Operator pathway · foundation 03
A limit a model can talk its way past isn't a limit.
A mandate names a budget. Policy enforcement is what actually stops the agent at that budget — and it only works if the stopping happens outside anything the model can reason, argue, or hallucinate its way around.
Learning boundary. This lesson teaches an operating model. It is not a certification, security assessment, legal delegation, financial recommendation, or approval to use production funds.
Learning objective
Separate five enforcement surfaces.
By the end of this lesson, you should be able to inspect a proposed spend-policy implementation, assign evidence-based readiness scores, identify which controls live in the prompt versus the infrastructure, and explain why a documented limit is not the same as an enforced one.
Where can value go?
Enforce destination addresses or entities at the infrastructure layer — a recipient check the model performs by reading a list in context is a suggestion, not a control.
How much, one time?
Set a hard maximum per transaction that the signing or execution layer refuses to exceed, independent of what the agent believes the situation justifies.
How much, per window?
Cap transaction frequency and cumulative spend over a rolling window — a per-action ceiling alone does nothing to stop many small approved actions from adding up to an unapproved total.
How much, ever?
Track total spend against a hard lifetime or period ceiling for the mandate, enforced by a system the agent cannot reset or reinterpret on its own.
Practice lab · evidence before confidence
Score a spend-policy implementation.
A procurement agent's system prompt states: "Never spend more than $500 per vendor per day, and only pay allowlisted vendors." The payment API accepts any recipient address and any amount the agent submits; there is no server-side check. The team has tested that the agent refuses out-of-policy requests in conversation, but has not attempted to bypass its own instructions via a crafted input.
- Score each dimension from 0: absent, 1: documented, or 2: tested.
- Name every claim that requires evidence before awarding a point.
- Identify the critical gaps that prevent a bounded pilot.
- Write the smallest safe next experiment.
Answer rationale
Recipient allowlist and per-action ceiling are both 0, not 1 — a rule stated in a system prompt and never enforced by the payment API is not documentation of a control, it's documentation of an intention the model can be argued out of. Velocity and aggregate budget are 0: nothing tracks spend across actions or time at all. "Refuses in conversation" tests compliance under normal use, not resistance under adversarial input, so no dimension earns a 2. The appropriate next step is moving the $500 and allowlist checks into the payment API itself — not refining the prompt language further.
STOP → ENFORCE