Guide

Whitelist merchants only

If your agent can spend, restrict it to an allowlisted set of merchants or counterparties so a prompt or loop cannot pay an unexpected payee. Pair it with fund the session ceiling, connect only what you need, and never skip review before place.

By Agent Lane Editorial · Page dated 27 September 2026

Answer first

Before Cursor or Grok can call a live brokerage or payment connector, write who the agent may pay — then keep spend inside that allowlist. Caps bound how much. Review bounds whether a place happens. Without a merchant or counterparty list, a drifted prompt can still send the capped amount to a new address, venue, or vendor. Agent Lane publishes the checklist. We do not place trades, hold wallets, or run your agents.

What this page is

A short operator guide for the payee-boundary habit on the shield — allowlist merchants and counterparties before a live run. Pair it with fund the session ceiling, connect only what you need, never skip review before place, agent spend caps, dedicated agent wallet, review before place, one connector at a time, paper before live, and the shared-box checklist.

We are a publisher, not a trading desk. Product screens change; confirm merchant, destination, or counterparty controls on the official page. We do not invent product allowlist menus or click-paths.

Why an open payee set is the failure mode

• Cap without destination. Session and daily maxes stop oversized fills; they do not stop a wrong payee at the same size.
• Tools without a who-list. A live payer, brokerage, or x402 path that can reach “anyone” turns prompt drift into an unexpected transfer.
• Skip-the-card with a fat destination space. Standing auto-place plus an open counterparty set is how one loop pays someone you never named.

What “whitelist merchants only” means

• Write the allowed set before connect. Merchants, counterparties, destinations, wallet addresses, symbol sets, or x402 endpoints this run may touch — and nothing else.
• Use official controls when they exist. Merchant, destination, or payee restrictions the product already exposes. Do not invent a screen.
• Enforce at review if the product has no list. Standing rule: destination outside the written set is a hard stop — see never skip review before place.
• Bound cash and tools too. Fund the session ceiling; connect only what you need.
• Close when idle. Receipt log, empty sleeve, revoke connectors when idle — do not leave an open payee set beside live grants overnight.

Where it sits in the shield stack

1. Dedicated agent wallet — money the bot can reach; long-term holdings stay outside.
2. Spend caps + fund the session ceiling — bound and fund only this run.
3. Connect only what you need — minimum live tool set.
4. Whitelist merchants only — allowlisted merchants/counterparties; refuse unexpected payees.
5. Review before place / never skip review before place — human gate on amount, destination, asset, and venue.
6. Revoke connectors when idle + empty the sleeve overnight — close grant and park cash when done.

Healthy live run uses cash bound + tool minimum + payee allowlist + human review. Skip the allowlist and a capped place can still hit the wrong destination.

How to whitelist merchants only

1. Write the allowed payee set. List merchants, counterparties, destinations, or venues this run may pay — names, addresses, or product labels you already control. Anything else is out of scope.
2. Apply the allowlist where the product already allows. Use official merchant, destination, or counterparty restrictions if the connector or wallet exposes them. Do not invent a product screen. If none exists, keep the list in standing rules and enforce at review.
3. Fund only the session ceiling. Empty or park excess, then fund only the session or daily ceiling — see fund the session ceiling and agent spend caps.
4. Connect only what you need. Enable only the MCP connectors and tools this job requires — connect only what you need. Reopen with one connector at a time.
5. Keep review before place on. No standing “just place it / don’t ask / skip the card” — never skip review before place. At each place, confirm amount, destination, asset, and venue against the allowlist; destination outside the list is a hard stop. Prefer paper before live on a new payee set.
6. End of session. Write a receipt log after the session; prefer confirm fills in the broker, not chat; empty or park the sleeve; revoke connectors when idle. If something misfires: revoke before you debug.

Practical checklist

• Who before how much. Allowlist written before fund and connect.
• Official controls only. No invented product allowlist UI — use what the product already exposes, or enforce at review.
• Cash + tools + payees. Ceiling, minimum connectors, and merchant list together.
• Review stays on. Outside-list destination = hard stop.
• Shared-box pass. Connectors and open sessions on a shared computer — see shared-box.

Brokerage path: Shield brokerage spend. On-chain pay: Shield crypto spend and x402 buyer basics.

What Agent Lane does not do here

• We do not place trades, preview your orders, or babysit your agents.
• We do not hold your funds, run a hot wallet, or settle payments.
• We do not invent merchant-allowlist UIs, payee screens, or API blocklists for readers.
• We do not publish “pay whoever the prompt names” as a workflow.

Related guides

• AI agent sent crypto by mistake: what you can and can’t undo
• Fund the session ceiling
• Connect only what you need
• Never skip review before place
• Review before place
• Agent spend caps
• Virtual cards for AI agents: what limits actually exist
• Dedicated agent wallet
• One connector at a time
• Paper before live
• Receipt log after the session
• Confirm fills in the broker, not chat
• Revoke connectors when idle
• Empty the sleeve overnight
• Revoke before you debug
• Session time-box
• Write invalidation before entry
• Reject duplicate place same thesis
• Confirm symbol before place
• No scale-in without GO
• Flatten all before connector revoke
• One order per idea until fill
• No place while unconfirmed fill
• Write max loss before entry
• Shared-box and connector checklist
• Shield brokerage spend
• Shield crypto spend
• x402 buyer basics
• Dry run before first live place
• Kill switch before travel
• Two-person rule for large places
• Log session end checklist
• Separate funding from trading wallet
• Name the strategy before connect
• Cap daily loss before session
• More on Resources

FAQ

What does whitelist merchants only mean?

It means: if your agent can place, pay, or sign, restrict spend to an allowlisted set of merchants or counterparties you already approve — so a prompt, retry, or loop cannot pay an unexpected payee. Pair with fund the session ceiling, connect only what you need, and never skip review before place.

Why is an open payee set the failure mode?

Caps and ceilings bound how much. Review before place bounds whether a place happens. Without a merchant or counterparty allowlist, a drifted prompt can still send the capped amount to a new address, ticker venue, or vendor you never intended.

How does this pair with fund-session-ceiling and connect-only-what-you-need?

Fund the session ceiling limits cash on the sleeve. Connect only what you need limits which tools are live. Whitelist merchants only limits who those tools may pay. Use all three before a live run.

Does the allowlist replace review before place?

No. Never skip review before place. The allowlist shrinks unexpected payees; the human gate still checks amount, destination, asset, and venue on each place. One yes is not forever.

Do I invent a product allowlist screen?

No. Use whatever merchant, counterparty, destination, or payee restriction the official product already exposes — or keep destinations you approve in your own standing rules and refuse anything else at review. Agent Lane does not invent product menus, click-paths, or API blocklists.

What counts as a merchant or counterparty here?

Anyone the agent might pay or trade toward: a vendor, a wallet address, a brokerage symbol set, an x402 endpoint, or another named payee path your connector can reach. Write the allowed set before connect; treat anything outside it as a hard stop at review.

Where do I apply this next?

Cash: fund the session ceiling. Tool surface: connect only what you need. Human gate: never skip review before place. Caps: agent spend caps. Separate path: dedicated agent wallet. Incident: revoke before you debug. Agent Lane publishes the checklist; we do not place trades or hold wallets.

Next steps

Before an agent touches real money, give the agent its own dedicated wallet, set hard spend caps, and shield your crypto. Or browse all Agent Lane guides.