How the desk decides
BurzoSpendDesk keeps rules, never money. You keep funds in your own wallet and give the desk an ERC-20 allowance. Each payment is checked and moved in one call.
One agent, several limits
Limits are set per agent and per token, in the token's own units.
| Limit | What it does | Where it stops |
|---|---|---|
| Daily budget | The most this agent can spend in this token in one UTC day. It resets at 00:00 UTC. | It is a calendar day, not a rolling 24 hours, so two days' limits can go around midnight. |
| Payment cap | The largest single payment. Above it, the desk refuses and does not queue. | It limits one payment. Many payments under the cap are stopped by the auto limit, the threshold and the daily budget. |
| Approval threshold | Above this amount and up to the cap, a request waits for you. Set it equal to the cap and nothing waits; set it to zero and everything does. | It limits one payment, not the day. The auto limit is what stops payments split below it. |
| Auto limit | The most that can move without your approval in one UTC day. A payment that would pass it waits for you, as one above the threshold does. What you approve counts toward the daily budget, not this limit. It must be no larger than the daily budget; zero sends everything to you. | It bounds, it does not stop: a stolen key can still move up to this per day, and double across UTC midnight. Setting the auto limit equal to the daily budget opens splitting again: payments below the threshold can then spend the whole day with no approval. |
| Approved providers | The addresses this agent can pay, up to 64. Your own wallet and the agent's own key cannot be on the list. | It says nothing about the work. The desk cannot see whether a provider delivered. |
Requests
A payment above the threshold, or one that would pass the auto limit, opens a request. It moves nothing and uses no budget. You approve or reject it with a transaction from your wallet. When you approve, the desk reads every rule again, except the threshold and the auto limit you are answering: a provider you removed, a limit you lowered, a freeze or a day already spent will refuse it, and the request stays open so you can fix that and try again.
A request expires after three days. An agent can hold at most 32 open requests, so a stolen key cannot fill your screen with thousands of them. You can reject up to 32 in one transaction; any already closed are skipped, so nobody can undo the batch by closing one first. Rotating the key closes them all. An expired request cannot pay, but it keeps its place until someone closes it.
Stopping an agent
| Action | What it does | What it leaves in place |
|---|---|---|
| Freeze the agent | One transaction. Its payments are refused until you restart it. | It does not revoke an allowance. |
| Freeze the fleet | One transaction, one storage write, whatever the number of agents you own. | It does not revoke an allowance. |
| Rotate the key | The old key stops working in that transaction. The limits stay. | Rotating a key closes every open request of this agent as rejected, honest ones too, so the agent has to ask again. It does not revoke an allowance, and today's spending stays counted. |
| Remove a budget | The agent can no longer spend that token. Today's spending is remembered if you add the budget back. | Removing a budget does not revoke the allowance. The token still lets the desk pull that amount until you revoke it. |
| Revoke the allowance | A call to the token, not to the desk. It cuts the desk off from your wallet in that token completely. | It is per token: other tokens keep their own allowance. |
| Retire the agent | Final. It leaves your fleet and its open requests close as rejected. | Retiring an agent does not revoke the allowance. Revoke it as well if no other agent of yours uses this token. |
Who can do what
| Action | Owner | Agent key | Provider | Anyone |
|---|---|---|---|---|
| Register an agent (you become its owner for good) | Yes | No | No | Yes |
| Set limits, list providers, rotate the key | Yes | No | No | No |
| Freeze one agent, or the whole fleet | Yes | No | No | No |
| Ask for a payment within the limits | No | Yes | No | No |
| Approve or reject a request | Yes | No | No | No |
| Withdraw a request it opened | No | Yes | No | No |
| Close a request past its expiry | Yes | Yes | Yes | Yes |
| Change the rules for all owners, take a fee, upgrade | No | No | No | No |
What it leaves out on purpose
- No transfer of ownership. Allowances are given to one shared desk, so moving an agent to another owner would let anyone aim an agent at a victim's wallet.
- No native coin. ERC-20 tokens only.
- No admin, fee, pause or upgrade. If the contract has a fault, the way out is to revoke your allowance and move to a new deployment.
The simulator and the contract give the same answers
The simulator uses a TypeScript copy of the rules. The two are held equal by 162 shared test cases, each evaluated by that code and replayed against the real contract through the check view and a real payment, and by 27 replayed days of payments, approvals and midnights, compared step by step.
Contract
Not deployed yet on Robinhood Chain. Solidity 0.8.28, no constructor arguments. Machine-readable ABI: contracts.json. Measured gas on a local chain: deployment 3,336,386, direct payment 103,707, approval with payment 121,997, fleet freeze 45,177. At 0.02 gwei a direct payment would be about 0.0000021 ETH, plus any data fee your wallet shows.
Read the risks before you sign anything.