Skip to main content
Prava doesn’t have a standalone “wallet” object. What it has is an account owned by a person or business — the agent owner — managed from the Prava Wallet Dashboard. The account holds the enrolled cards and saved addresses, and the owner authorizes one or more AI agents to pay on their behalf.
With Prava, the agent never holds funds or a raw card. It acts against the owner’s account under the owner’s controls, and only ever receives one-time, scoped credentials at the moment of purchase.

​
The model

  • Agent owner — a dashboard user who owns the account and manages everything at pay.prava.space.
  • Cards & addresses — enrolled once and held on the owner’s account.
  • Agents — the owner links and approves each agent; every agent gets its own secure identity.
  • Shared access — all of an owner’s agents draw on the same cards. There are no per-agent card permissions.

​
Authorizing agents

An agent is connected through the linking flow: it requests access, and the owner approves it in the browser. From then on an agent is simply active or revoked — it’s all-or-nothing, not a permissions matrix. Revoking an agent cuts off its access immediately.

​
Spending controls

These are the controls that actually exist and are enforced:
ControlWhat it doesWhere it’s enforced
Checkout quotaA set number of checkouts allowed per owner (a lifetime count), consumed as agents buy.Prava (application level)
Concurrency limitCaps how many checkouts can be open at once (a small number).Prava (application level)
Per-purchase approvalEvery spend requires explicit approval before it happens — the Skills enforce a hard stop for agents; SDK/hosted flows use passkey confirmation.Owner / device
Per-merchant amount limitsWhen a card is enrolled for agentic commerce, each authorization is locked to the merchant and amount.Card network (Visa)
Quota and concurrency are Prava application-level limits. Merchant/amount locking is enforced by the card network. See Guardrails for the network-level detail.

​
Cards on the account

Cards are enrolled through Prava’s secure collection (collectPAN or a hosted page) and tokenized — the raw card never touches the app or the agent. Each card carries:
  • a status (active / deleted),
  • an agentic-commerce flag (isAgenticCommerceEnrolled) indicating it’s enabled for AI-initiated purchases,
and is visible from the dashboard and the List Cards API.

Link an agent

How an owner approves an agent against their account.

Guardrails

The network-level constraints on what an authorized purchase can do.