Arms and budgets
Each wallet has eight arms, numbered 0 to 7. An open arm has two limits, one onchain and one checked by the facilitator.
| Limit | Where it lives | What it does |
|---|---|---|
| Budget | The arm's SPL delegated amount | The session key can move at most this much USDC out of the arm, relay fees included. The token program lowers it on every transfer and clears the delegate at zero. It also cannot exceed what the arm holds. |
| Daily cap | Signed rules | The facilitator refuses a payment that would take the arm's relayed spend for the UTC day, fee included, above the cap. |
| Allow-list | Signed rules | The facilitator relays payments only to the payTo addresses listed, at most 16 per arm. |
Giving an arm
One owner transaction: createAccountWithSeed at the arm's address (your wallet pays the rent, about 0.00204 SOL), InitializeAccount3 with your wallet as owner, TransferChecked of the budget from your USDC account into the arm, ApproveChecked with the session key as delegate, and a Memo allow:arm:<n>:<rule hash>. Before it, your wallet signs the rules as a plain message. An arm address someone pre-funded with lamports is taken over with allocateWithSeed instead, so nobody can block an arm number.
Refill
A top-up (TransferChecked into the arm) and a new ApproveChecked, in one transaction. A new approve replaces the budget, it does not add to it. Changing the cap or the allow-list is a new signed message, with no transaction.
What an agent can do
- Relayed payment: sign a transfer from its arm, the facilitator pays the fee. This is what x402 uses. The agent needs no SOL.
- Direct payment: send the transfer itself and pay its own SOL fee. No relay fee. The facilitator is not involved, so the daily cap and the allow-list do not apply to it; the onchain budget does.
A session key cannot touch your wallet's main USDC account, your SOL, another arm, the arm's ownership or its closing.
Ink
For every open arm, TransferChecked of its whole balance back to your USDC account and CloseAccount(the rent goes back to your wallet), in one transaction. Eight arms take 779 bytes, under Solana's 1,232. If an agent payment lands between the read and your signature, the transaction fails as a whole, nothing moves, and the app reads again.