Sign spending limits for an AI agent, then try to break them. Everything runs in your browser. Keys are made here and thrown away when you close the tab.
What the owner lets the agent do. Lists are comma-separated. post.* covers every post type, and *.stripe.com covers its subdomains.
Before acting, the agent checks the request against the signed mandate. Try these:
Every decision is chained to the one before it by a SHA-256 hash. Edit one past entry and the audit shows exactly where.
| # | Decision | Request | Why | Hash |
|---|
Sign a mandate to see it here.