Build a wallet service as a budget enforcement layer between an agent and a PSP

Steps

1. Create a wallet entity per agent scope (per agent instance, per project, or per human principal as fits your model) with a balance field and a set of policy rules: max_balance, max_single_transaction, daily_limit, allowed_merchant_categories.
2. Fund the wallet via a separate, human-initiated top-up flow — the agent cannot fund its own wallet; this separates the authorization to spend from the act of spending.
3. When the agent wants to make a payment, it calls your wallet service (not the PSP directly); the wallet service checks all policy rules, deducts the pending amount from the available balance (reserving it), then forwards the payment to the PSP.
4. On PSP confirmation, finalize the deduction; on PSP failure, release the reservation back to the wallet balance; write both outcomes to the audit log.
5. Expose a wallet balance and transaction history endpoint to the human principal; send alerts when the balance drops below a configurable threshold.
6. Implement a hard stop at zero balance — the wallet service must refuse to forward any payment request that would result in a negative balance, regardless of how the agent is instructed.