Put a compliance firewall on your agent
One entry, one gateway: register an agent, set its mandate (limits/allowlist/purpose), and every payment runs 11 gates before settlement — over-reach, hijacks, impersonation, replays, sanctioned payees, all blocked before money leaves. The tabs below (firewall / KYA identity / x402 preflight / address screening) are facets of the same live gateway.
Or: wire it in with the SDK, in three lines
import { createPayClient } from "@oceanalt/pay";
const oa = createPayClient();
// 注册 agent + 它自己的授权信封
const reg = await oa.register({ agentId: "my-bot", entity: "Acme (KYC)",
mandate: { maxUsdc: 5, dailyUsdc: 50, payees: ["0x…"], purpose: "buy-data" } });
// 通过防火墙付款(nonce/凭证自动处理)
const r = await oa.pay({ agentId: "my-bot", amountUsdc: 2, to: "0x…", purpose: "buy-data" });
r.decision === "allow" ? settle() : console.warn("被拦于", r.pillar, r.reason);