Saku: give an AI agent a budget, not a key

An agent that pays for API calls needs a wallet. The usual way to give it one is to hand it a private key. Whoever steals that key can spend everything in the wallet, and an agent's key lives in places keys should not: environment variables, logs, other people's servers.

Rules in a contract, not in the agent

Saku turns this around. The agent holds no key that can move money. A NEAR contract owns the agent's wallet on Base through NEAR Chain Signatures, and the contract signs a payment only when it fits the owner's rules:

• a daily budget;
• a per-payment limit the agent can spend on its own, with larger payments waiting for the owner;
• a list of sellers the agent may pay.

The agent can only ask. If someone steals the agent's key, the most they get is what is left of that day's budget, paid to sellers on the owner's list.

Try to break it

The page at saku.glianalabs.com publishes a real test agent's key on purpose. Use it to send money to an attacker, overspend, or add yourself as a seller, and watch the contract refuse. Every button sends a real transaction from your browser, on testnet.

Saku is our entry for the NEAR hackathon, built on the same pay-per-call rails as GlianaAI.