How it works
One mandate. Four fields. No keys.
Bridle lets an AI agent spend without holding a key. You set the limits, the agent proposes payments, and a contract on NEAR decides each one against your rules.
- 01
You write the mandate
A mandate is the rulebook for one agent. You set a per-payment cap, a daily cap, the chains and assets allowed, the recipients it may pay, a pause threshold for larger payments, and an expiry. You can write it as a sentence and sign it once. Raising a limit later waits out a delay, so a hijacked session cannot loosen it instantly.
- 02
The agent proposes
The agent never holds a spend key. It sends four fields: chain, asset, amount and recipient. That is the only action it has. It cannot edit the mandate, add a recipient or sign anything itself.
- 03
The contract decides
The contract checks the proposal against the mandate in a fixed order. A payment that passes is queued for signing. One that breaks a rule is refused, with the rule named. One over your pause threshold waits through a challenge window.
What the contract checks
Eight checks, always in this order
- 01Mandate is not revoked or expired
- 02Agent bond is posted
- 03Chain is allowed
- 04Asset is allowed
- 05Recipient is on the approved list
- 06Amount is above zero
- 07Amount is within the per-payment cap
- 08Amount fits what is left of today's cap
What happens to a payment
Every proposal ends one of five ways
- ReadyWithin every limit and under the pause threshold. Queued for signing.
- WaitingOver the pause threshold. Held for the challenge window while you or a watcher can step in.
- FlaggedA watcher put up a bond to challenge it. It stops until you decide.
- VetoedYou said no. It never executes.
- RejectedBroke a rule: wrong chain or asset, recipient not approved, over a cap, or the mandate is revoked or expired.
Today Bridle runs on NEAR testnet. A ready payment is marked for signing; cross-chain signing is built for Base and Solana is planned, and nothing here moves real funds yet.