Waysafe

Docs

Waysafe

Waysafe decides whether an AI agent may take an economic action. A principal states an authority in their own words; it compiles to a policy, they sign it with a passkey, and the version freezes. From then on every spend is checked against that exact policy by deterministic code, and every decision is written to a signed, hash-chained log anyone can verify without trusting Waysafe.

Waysafe sits between the principal who signs a policy and the two payment rails that settle: Stripe asks it before any card charge, and the Safe cannot settle on one signature, so both rails reach the merchant only through a decision Waysafe made. The agent's own call to Waysafe is a preflight, never a control.
Who holds which key, and who asks whom. The same diagram opens Concepts and docs/THREAT-MODEL.md §0.1.

The one rule: the rail asks Waysafe before money moves; the agent never has to. Anything that depends on the agent calling Waysafe first is a preflight — useful, never the thing that stops a payment.

What you can build

  • A card program. Point your Stripe Issuing real-time authorization webhook at Waysafe; every authorization the network presents is decided against the mandate and declined unless the decision is an ALLOW, with no agent-side code at all. A settlement the network clears without asking is recorded and flagged rather than stopped — see Enforcement.
  • Wallet / x402 infrastructure. Deploy a 2-of-2 Safe per mandate with Waysafe as the second owner; a transfer the policy refuses simply cannot be signed.
  • An agent platform. Call authorize() as a preflight to get a decision and a receipt before acting — with a real rail behind it doing the enforcing.

Start here

QuickstartFive commands to a real decision, locally.EnforcementThe two endpoints a rail calls before money moves.ConceptsMandate, version, authorization, evidence.ReferenceSDK methods, raw REST, and every reason code.Policy schemaEvery field, and whether the engine enforces it today.

Where this stands

  • The policy engine and evidence chain are real and running.
  • On-chain decisions are live on Polygon Amoy testnet against a deployed 2-of-2 Safe.
  • Card decisions run the real engine against recorded Stripe Issuing authorization requests. Live sandbox authorization is pending Stripe’s live Issuing onboarding.

Source

Everything described here is public source. Read github.com/getwaysafe/waysafe — or go straight to docs/THREAT-MODEL.md, which inventories every key, what five compromise scenarios actually yield, what the evidence chain does and does not prove, and the gaps that are still open.