Control is a design decision.
Wallito is a sandbox payment-governance service. These are the controls implemented in this release, and the boundaries you should understand.
Deterministic authorization
Policy decisions run on the server. Hard limits, vendor origins, exact recipients, allowed assets, and emergency controls take precedence over human approval. Prompts and resource descriptions cannot change these rules.
Separation of authority
Agents propose payments with one credential. A trusted executor consumes single-use grants with a separate credential. Keep executor credentials and signers outside the agent runtime. Wallito cannot govern unrelated credentials or payment paths.
Durable accounting
PostgreSQL transactions serialize decisions per workspace. Outstanding reservations count against limits. Submitted or uncertain payments retain reservations until reconciliation; expiration alone never releases them.
What is not yet claimed
This release does not execute real payments or independently verify on-chain settlement. It has not received an external security audit, SOC certification, or regulatory approval. Step-up authentication, tamper-evident offsite audit archives, and production recovery exercises remain launch requirements.
Report an issue
Do not include credentials or private financial data. Contact the project owner through your existing support channel. A public support mailbox must be configured before commercial launch.