The vault owner fixes the rules on-chain: a per-transaction cap, a daily cap, and the list of recipients the agent is allowed to pay.
The AI agent holds its own key and pays for services from the vault. Any payment outside the policy reverts on-chain, no exceptions.
Deposits, spends and policy changes are recorded as events on Arbitrum Sepolia, so the owner always sees the same truth as the chain.