An obol is a unit of permission small enough to spend on one action. This page describes the coin, the rules it obeys, and the gate that takes it. It is a design in progress — the parts already proven in our lab are marked.
“Clean up the failing tests in this repo.” “Pay the electric bill.” The request is the only source of authority. Nothing the agent reads later can add to it.
The agent drafts the smallest set of actions the task needs. You see it in plain English and approve with your key — a tap, a passkey, a hardware token. Routine tasks can draw on a pre-approved allowance.
The gate checks the coin against the exact call: tool, target, arguments, limits, expiry, and the origin of every argument. Pass: the call runs and the coin burns. Fail: refused, and you're told why.
Unspent coins expire. The receipt chain closes. The next task starts with no authority at all — the agent has to ask again.
The for line is kept verbatim so every receipt can be read against what was actually asked. The origin line is what makes injected text inert: it can reach the agent's context, but values derived from it can't pay for this action.
The agent process holds no long-lived credentials. Real secrets live behind the gate; the agent only ever holds coins, and coins expire.
Tool, audience, and argument constraints are part of the coin. Rephrasing the request doesn't change what the coin covers — the gate compares calls, not words.
An agent can hand a sub-agent a narrower coin. It can never hand over more than it holds. Every delegation is a strict subset, and the chain is visible in the receipt.
Data from untrusted sources carries its origin into every value derived from it. A coin states which origins may shape its arguments. This is the Rule of Two enforced by bookkeeping instead of hope.
Memories, self-written skills, and scheduled jobs can store instructions. They can't store power. When a saved job fires, it needs a fresh coin — which is exactly where a sleeper injection gets caught.
Receipts are hash-chained and human-readable: request, coin, call, argument origins, result. Refusals are receipts too.
Checking a coin is signatures and comparisons. No model sits in the enforcement path, so there is nothing at the gate to persuade. Models help draft coins and explain refusals — they never decide one.
One coin format, several gates. Each sits where an action becomes real.
A proxy in front of MCP servers. Before a coin exists, the agent sees one tool: request_coin. After minting, only the covered tools appear — and every call is checked against the coin.
For agents with built-in tools (file read, edit, shell), a pre-tool hook asks the gate before each call and a post-tool hook tags what came back with its origin.
The agent runs as its own OS user. The kernel routes its traffic through the gate; anything without a coin for that destination doesn't leave the machine.
Agent payment protocols already carry signed mandates for what a user authorized [3]. An obol maps onto them cleanly: a spend cap is just a caveat, and the receipt is the proof of intent.
OAuth and MCP authorization answer “who is this client, and may it talk to this server?” The current MCP spec binds tokens to a single server and forbids passing them along [1]. That is necessary. It's also coarse: a token with files:write says nothing about which file, for which request, shaped by which input. Obol lives one level down — per call, per argument, per task.
Token exchange (RFC 8693) answers “who is acting for whom?” [2] Obol records the same actor chain in every receipt and adds the rule that the chain can only narrow.
Guardrail classifiers answer “does this text look malicious?” Keep them — they catch the obvious and they're a useful early warning. Obol doesn't need them to be right.
Capability research answers “how do you keep untrusted data out of control flow?” CaMeL showed that tracking where values came from, and checking policy at tool-call time, gives provable security on a real benchmark [4]. Obol takes that idea out of one interpreter and puts it on the wire, where any agent can use it.
It doesn't stop injection. The agent can still be fooled. Obol limits what a fooled agent can spend to what the current coin covers.
It can't fix a bad mint. If you approve “email anyone anything,” the gate will honor it. That's why minting is plain English and coins default narrow.
It can't see what never crosses a gate. Harm done purely in text — a wrong answer, a bad summary — isn't an action. Covert channels inside legitimate outputs remain hard.
Root beats everything. If the agent runs with enough privilege to rewrite the gate, the gate is decoration. The agent runs as its own unprivileged user for that reason.