Bounded wallet permissions for AI agents

Useful payment authority is narrow, observable, revocable, and unable to drift into a general-purpose wallet mandate.

Minimum policy

Allow only official USDC on one approved network.
Allow only the recipient returned by the verified quote.
Cap the exact transaction and total daily amount.
Expire approval quickly and make it revocable.
Require fresh approval if any transaction field changes.
Stop after an error, ambiguous receipt, or conflicting order state.
Never reveal a seed phrase or private key to a merchant or tool.

Separate paying from judging success

A wallet receipt proves that a transaction was broadcast. It does not prove the merchant accepted it or completed the service. Use the merchant's authenticated order status, and require fulfilled before reporting completion.

Fresh SEM's boundary

The Fresh SEM MCP server supplies exact payment requirements and verifies public chain data. It does not connect to wallets, hold keys, sign, or broadcast.