A spending mandate
held in a Secure Element
A human grants one envelope with one tap — this agent, this budget, this ceiling, these payees. The agent then runs unattended on a machine with no key on it, and every payment is checked inside a chip no host can read or edit.
-
1
A human hires an agent
Pick what you are hiring. The Flex will show you those exact terms — the job, the budget, the most it may spend in one payment — and wait for a finger. This is the only tap in the whole story.
-
2
The agent spends on its own as —
Nobody touches the device again. Every payment is checked inside the chip against the terms from step 1 — and the chip is the only thing that can say no.
the chip decides. This page only asks.
-
3
A human takes it back
One tap and the envelope is gone from the chip. No key is rotated, nothing is redeployed, and the machine the agent was running on never held anything to take away.
None of this has to be taken on trust — check every payment against Hedera yourself, in your own browser.
- no contract calls
- —
- —
- nothing flagged
No agent is running. Start one with
VELA_EVENTS=http://127.0.0.1:4050/api/events node agent/swarm.mjs
A container with no device, no volume and no key. It takes its token from the Key Ring and pays through the gateway.
Runs whichever agent is selected in the fleet below — currently none.
Runs remote-1 on a GitHub runner: no USB bus, no Ledger tooling, no seed, no envelope. It buys one inference, then asks for eight times the ceiling and the chip refuses it. Opens a tunnel for the duration and closes it after.
Or hold the tunnel open by itself. While it is up, anyone with the URL can burn that envelope down to its allowlisted payee.
The chain against itself, and the chain against the chip. Neither reads anything this host holds.
A transfer names its payee in the transaction, so any software policy can read it. A contract call names only the contract — where the value lands is an ABI argument the transaction does not interpret, and under prompt injection that argument is exactly what an attacker rewrites.
Same contract. Same function. Same amount. One field differs: the address in argument 1.
Every draw is anchored on Hedera with a statement the chip signed. Anyone can check it from the mirror node without trusting this page.
- nothing yet