Get started
Core concepts
The handful of ideas that explain everything else: accounts, policies, the buffer, parking and debt.
Owner and signer
Every agent account has two keys with very different powers. The owner is your wallet. It can do everything: change the policy, add payees, fund, unwind, withdraw, pause and revoke. The signer is the key your agent runs with. It can do exactly one thing: ask the account to pay someone, within the policy.
This split is what makes it safe to give an AI model access to money. If the signer key leaks, the worst case is bounded by your daily cap and your payee list, and you can revoke the signer from the owner wallet.
Spending policy
The account contract checks every payment against its policy before any money moves:
| Per-call cap | Maximum amount of a single payment. |
|---|---|
| Daily cap | Maximum total per UTC day. It resets at 00:00 UTC. |
| Payee allowlist | Addresses the agent may pay. Enforced strictly on chain. |
| Domain allowlist | API hosts the agent may pay, such as api.example.com. Matching relies on the host the SDK reports. |
| Pause and revoke | Pause stops payments until resumed. Revoke disables the signer permanently. |
The SDK also lets you set a per-request maxAmount. It is checked before anything is signed, as an extra guard on top of the on-chain policy.
Liquid, parked and net balance
An account's money is always in one of two places:
- Liquid: plain USDG in the account, used first to repay the buffer.
- Parked (also called working): USDG value held in spUSDG through the adapter, earning the asset's variable rate.
The net balance is liquid plus parked minus debt. It is what the account is really worth, and what low-balance alerts watch.
The buffer and debt
When an agent pays, the buffer pays the merchant immediately. If the account has enough liquid USDG, it repays the buffer in the same transaction. If its money is parked, the account carries a debt to the buffer for the amount plus the fee, and the debt is settled from the parked position shortly after.
An account can never owe more than it is worth: the router refuses a payment that would leave debt uncovered by the account's collateral. That keeps the buffer whole even if an agent misbehaves.
Keeper and permissionless valves
A keeper service parks idle cash and unwinds positions. It holds a narrow role: it can only move an account's funds between the account and registered adapters. Two functions need no role at all, so the system keeps working even if the keeper stops: settleDebt repays an account's debt from its own parked funds, and refillBuffer tops the buffer up from its own parked position.
Timelock
Every contract is administered by a TimelockController with a 24-hour delay. Fee changes, new assets, caps and role changes are scheduled publicly and can only execute a day later. The admin can pause in an emergency without the delay; pausing never blocks owners from exiting their accounts.