A wallet binds your saved debit card and the mandates that spend through it.
Saved once with 3-D Secure while you're present — your agent then spends within its mandate, never holding the card itself. Debit only: credit lines are exactly the unbounded exposure this product exists to avoid.
Stripe isn't configured — attach the demo debit card (visa ···· 4242) to continue.
Test card: 4000 0582 6000 0005 (debit) · any future expiry · any CVC
The allocation and its rules — signed by you, enforced server-side on every charge.
Give this to the agent (env var, MCP config). Only its hash is stored; it cannot be retrieved again.
This key can only attempt charges against its mandate. It cannot edit rules, raise caps, or touch instruments — those need your signed-in session.