Sheet II

Four ramparts,
in section.

Each rampart answers one question about a transaction. A transaction lands only if every answer is yes. They are checked in order, outermost first, and the first refusal ends the approach.

Scale 1 : tx
Ramparts IV
Drawn owner

The ditch — spend caps

The outermost line. Every transfer of value is counted against ceilings per transaction, per hour and per day. When a ceiling is reached the ditch is full: nothing more crosses until the window rolls over. This is what stops a loop that repeats a bad instruction on every cron tick.

Stops: Runaway loops, drain-by-repetition, a single oversized send
Lets through: Normal activity under the ceiling, without asking anyone
Counted in: Native ETH and listed tokens, each with its own ceiling
Changed by: Owner only. The agent cannot raise its own cap

The curtain — contract allowlist

A continuous wall with one gate. The agent may call only the contracts you named, and only the functions you named on them. Everything else meets the wall. Unlimited token approvals are refused outright, because an infinite approval is a hole in the curtain that outlives the transaction.

Stops: Unknown contracts, approve(MAX), calls to functions you did not list
Lets through: Listed contract + listed function, e.g. router buy/sell
Matched by: Address and 4-byte selector, not by name
Changed by: Owner only

The gate — time-lock

Moves above a threshold are not refused — they are held in the gatehouse for a fixed delay. During that window the owner can drop the portcullis and cancel. If nobody does, it can be released once the delay has passed. Autonomy is kept; surprise is removed.

Holds: Anything over the threshold you set
Releases: By agent or owner once the delay expires
Cancelled by: Owner, at any time before release
Visible as: A queued ruling with its release time

The keep — kill switch

The last place to retreat to. One owner-only command freezes every outgoing transaction at once — including anything waiting at the gate. The agent sits inside the walls and has no key to the keep; it cannot lift the freeze, and it cannot remove the owner.

Freezes: All outgoing value and all queued moves
Lifted by: Owner only
Agent can: Nothing — not pause, unpause, or reassign
Intended for: Compromised prompt, leaked key, bad skill update

Rulings

How the four combine on real approaches.

Approach	Ditch	Curtain	Gate	Keep	Ruling
buy 0.04 ETH on listed router	under cap	listed	below threshold	open	PASSED
approve(MAX) to unknown address	—	refused	—	—	TURNED BACK
same buy, 40th time this hour	cap reached	—	—	—	TURNED BACK
send 0.80 ETH to treasury	under cap	listed	over 0.50	open	HELD 6h
any move after owner freeze	—	—	—	sealed	TURNED BACK