Turnstile

The warm tier · read live from Privy

The mandate

org wallet 0x3De9…bE84
2026-09-11 07:52:30 UTC

The market page shows what is for sale. This is the other side: what a buyer’s agent is allowed to spend, and who decides. An organization wallet authorises an agent up to a cap, on named rails, without ever handing it the key that set the cap.

Spend cap

$1

Read off the live policy, not from a literal in the code. The code’s default is $0.25, and a quorum can move it; this is what the policy actually says right now.

Max per query

$0.1

Enforced by the agent before it pays, in `buyer/mandate/`.

Rails

2

arc-usdc · hedera-x402

Settled to date

$1.0550

25 payments that actually moved money, on both rails. Not a balance against the cap above — see below.

Who may authorise what

2 operators

Every value below was fetched from Privy when this page was requested. The two quorum ids differ, and that difference is the control: it is what stops the agent, or any one human, from widening its own limit.

  • wallet
    organization wallet

    0x3De96375140717193f52c220Df5Ec460971cbE84

    Privy id w0cxyoh1lnc1lqfyi9tb5yej. This is the warm tier: it holds the funds an agent draws on, and it is not the agent's key.

  • quorum
    operations quorum

    ywnbe62desoz63antrbsu5qs

    Owns the wallet. Signing a transaction needs its threshold, one of 2.

  • quorum
    board quorum

    cvwpn2cxf6z8fxs8fa9gl78x

    Owns the policy. Raising the cap needs this quorum and not the one above, at two of 2. Two different groups on purpose: the people who can spend are not the people who can decide how much.

  • policy
    Turnstile mandate — $1 cap

    crykqflf5ffiho8taei8uu7s

    Allows 2 calls, listed below the table.

  • allowlist
    sellers this mandate may pay

    0x0Adca6e14bA956201D221feC767e4f24194bf5F2

    0.0.10403961

    An agent holding this mandate cannot pay anyone else, on either rail.

  • ALLOW Fund the agent, within the mandate
  • ALLOW Approve the GatewayWallet, within the mandate

What it has actually spent

25 settled · $1.0550

Everything above is permission. This is what the agent did with it. Neither rail is read from a database of ours: Hedera receipts come off a public consensus topic through the mirror node, and Arc settlements come from Circle Gateway’s transfers API queried by the agent’s own address.

  • hedera-x402
    HBAR on Hedera testnet, settled through Blocky402

    12 settled · $0.840000

    HCS topic 0.0.10408013, via the public mirror node

  • arc-usdc
    USDC on Arc, batched through Circle Gateway nanopayments

    13 settled · $0.215000

    Circle Gateway's transfers API, queried by the agent's address

This is not a running balance against the cap. $1.0550 settled and a $1 cap are two true numbers that do not subtract from each other: these payments span several runs, and a quorum raised the cap partway through. Presenting them as one ledger would be a tidier story and a false one. Per-run enforcement lives in buyer/mandate/, where the agent refuses before it pays. Topic 0.0.10408013 has no submit key, so anyone may append to it and a receipt is a claim until checked against the ledger. npm run mcp’s receipts tool does that check.

13 older payments not listed. All of them are on the topic and in the Gateway API.

Prove the quorum is real

Everything above is a claim until something is refused. This asks Privy to raise the cap with one operator’s signature against a threshold of two. It is meant to fail, and the failure is the evidence.

This server never holds enough keys to succeed here. The second operator’s key is not read by this route, so no request to it can raise the cap. The two-signature path is npm run privy:mandate, run on an operator’s own machine.

What this page does not do

It does not issue a mandate and it does not raise a cap. Both need operator signatures, and a server holding enough keys to do either from a browser would defeat the property this page exists to show. That flow is npm run privy:mandate, which issues the mandate, funds the agent through depositFor, and shows the same refusal followed by a two-signature success.

Create your own mandate → Its operator keys are generated in your browser and never sent here, so the organization is yours whether you run it on this deployment or your own.

← The market page is live, and reads real registrations.