CAIN-42 CAIN StudioAGENTIC AI 75 · #22
Bounded agent identities and wallets
Cloudflare announced agent identities and wallets with spending caps, approved merchants and transaction limits.
Last reviewed 2026-11-11
Agentic AI 75 / #22
2026 status: Staged platform announcement · Category: Payments
The 2026 development
Cloudflare announced agent identities and wallets with spending caps, approved merchants and transaction limits.
The governance gap
A spending cap is a policy, and a wallet is a credential. The hard part is making the cap, the merchant list and the per-transaction limit hold at the moment of payment, not in a monthly report.
Where CAIN-42 fits: Moat 1 — Trust State
Core question: Who do we trust right now? Evidence-backed trust computed at the moment of the action, never a static badge.
Make the mandate the unit of authority: principal, agent, merchant set, amount ceiling, velocity, expiry and revocation. CAIN's payment-mandate guard evaluates all of them before release and records the decision.
How the wiring works
- Issue a signed mandate from the principal to the agent.
- Check merchant identity, including look-alike domains, before checkout.
- Enforce per-transaction and cumulative ceilings at authorization time.
- Release once, record the settlement, and revoke on anomaly.
What is real today
LIVE A public route in this deployment exercises this mechanism today, within its stated scope.
The hosted governor demo proves budget and velocity refusal on fixed presets. No real wallet, card network or Cloudflare product is involved.
| Component in this repository | What the module says it is |
|---|---|
cain/commerce/mandate_guard.py | Agent Payment Mandate Guard. |
cain/runtime/transactions.py | CAIN Sovereign — Machine-to-Machine Transaction Governance (Prompt 7, Phase 18). |
keystone/governor.py | SPEND GOVERNOR KEYSTONE: stops a runaway agent before the bill does. |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Run the live spending-governor demo
/governor-keystone - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | Agent Wallet Mandate Review |
|---|---|
| Buyer | Fintech, marketplaces and treasury teams |
| Price (proposal) | $3,500–$7,500 per review |
| Bundle | Commerce & Payments — Delegated spending with a ceiling and a receipt. |
| Operator stream | Stream 2 of the 10-stream operator playbook |
Fintech, commerce platforms, marketplaces, treasury teams is the bundle buyer. The entry offer for this bundle is Payment-mandate review; browser-agent checkout review; the range is $2,500–$7,500 per review; integration from $10,000. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-022 — Agent Wallet Mandate Review DELIVERABLE
A bounded engine run on the buyer's sample: findings, a written report, and a SHA-256 artifact manifest. The manifest is unsigned: it is not a signature and not an attestation.
Kind: Assessment · Price (proposal): $3,500–$7,500 per review · Lead time: 5 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.