Procurement Agent

Restocking a household is a queue of tiny purchases nobody wants to manage. This agent runs the queue: it notices a staple is low, sources it, and — when policy clears the purchase to run autonomously — pays with a virtual card minted for that purchase alone, locked to one merchant, capped at the mandate's dollar amount, retired after a single swipe. Novel asks like "buy a 6-ft HDMI cable under $20" ride the guarded rail instead: a card whose every authorization our own pure function rules in real time.

That card design is also the answer to agentic commerce's number-one risk — excessive agency, a model talked into spending money. Here the order of construction was inverted: the deterministic money control shipped before any AI existed. Every purchase rides a signed, TTL'd mandate that only deterministic code can issue, matched against real rails — Privacy.com cards whose merchant lock and cap the issuer enforces, and Lithic's auth stream where our own pure function approves or declines in under three seconds. There is no saved card on file for a hijacked model to drain.

The whole spine runs offline today — 54 tests, a creds-free demo that stages an autonomous purchase, parks a high-value one for human approval, and bounces a planted malicious listing. What's left is keys, not engineering.

Watch one errand run itself — and one attack bounce off the same gates:

The heart of the design is a split tool surface. The model is handed propose-only verbs — search, read stock, read history, draft an unsigned mandate. The money-moving verbs exist, but they are not in the model's tool list. They live in an authority plane only deterministic workflow code can call. The test for any new tool is one question: could a hijacked model misuse it to move money? If yes, the model never sees it.

Risk decides autonomy. The Haiku router suggests a tier, but policy.classify() — budget remaining, merchant and MCC allow-lists, learned price bands — recomputes it deterministically, and when they disagree the policy wins and the discrepancy is audited. Known replenishment runs autonomous on an issuer-capped card; novel or high-value purchases park for a human.

Phase 0 had no AI in it at all. Week one produced two working money-control modes: a Privacy.com card whose merchant lock and spend cap the issuer enforces, and a Lithic ASA webhook where decide(auth, rule) — a pure function with no network calls, no model, no clock dependency — approves or declines a live authorization. Only after the blast radius was bounded did a model get invited in.

The seam between thinking and spending is a signed mandate: { mandate_id, max_amount_cents, merchant_descriptor, item_description, expires_at }. The model drafts one as plain data. Deterministic code validates it against policy, HMAC-signs it with a TTL, and the auth handler matches live card events against open mandates. Prompts are framing; the signature is the security boundary.

08:00:00ReplenishmentWorkflow tick — sourcing.get_low_stock08:00:01low: coffee filters #4 — last paid $11.20, band $9–1308:00:03[router · haiku] class hint: AUTONOMOUS (advisory)08:00:03policy.classify → AUTONOMOUS — budget ok · merchant allow-listed · price in band08:00:09[sourcing · sonnet] 3 candidates → best $12.00, known merchant08:00:10[mandate.propose] draft: max $12.00 · ttl 24h · merchant-locked08:00:10policy.validate_mandate → ACCEPT · mandate.sign → hmac, ttl'd08:00:11card.activate → privacy.com · MERCHANT_LOCKED · cap $12.0008:00:14auth event ← lithic asa08:00:16match_auth + decide() → APPROVE — pure function, no model08:00:16audit: every step cites its rule. spent $12.00 — the exact cap.

1. Phase 0wk 1

   Both money-control modes, before any AI

   Issuer-capped card + pure-function auth decisions. The differentiator, retired first.

2. Phase 1

   Policy engine, signed mandates, Temporal

   Typed rules with an OPA-compatible seam; durable approval signal and timer.

3. Phase 2–3

   Gated commerce + sourcing + risk tiers

   One commerce.purchase() interface, backend-blind; price-band learning; the Haiku router that can only suggest.

4. Phase 5wk 2

   Red-team corpus

   Five attack classes driven end to end. Pass = zero unauthorized spends, every block rule-attributed.

Nothing live broke — by design, this system met its adversary in the test suite first. The red-team corpus plants real attacks and drives them through the full pipeline. The pass criterion is strict: zero unauthorized spends, and every block must be attributable to a deterministic rule, not model reluctance.

Everything blocked is a credential, not engineering: Privacy.com and Lithic sandbox keys to watch the gate rule a live auth, then ACP onboarding, then the portfolio centerpiece — an end-to-end purchase on Visa Intelligent Commerce rails, gated by this policy engine.

1. NX-01Live sandbox keys: watch decide() rule a real Lithic auth in production conditions.
2. NX-02Visa Intelligent Commerce sandbox — agentic tokens on the actual Visa rails, our gate in front.
3. NX-03Slack approval surface for the human tier — Temporal signal + durable timer are already waiting.
4. NX-04Evolve the mandate from HMAC to asymmetric signature and a verifiable credential (ADR 0006).