Skip to main content
An operations agent owns the address that vendors, SaaS tools, and registrars write to. It files invoices, answers routine vendor questions, and renews a domain or buys a small tool with its own card — within limits an owner set in advance. Every card authorization is checked in real time and appears under Wallet. Vendor logins and authenticator secrets live in the vault so the agent can handle portal 2FA without a human in the loop.

What you need

An agent equipped with an inbox and a token with the following capabilities:
  • email:read — to receive and read vendor mail
  • email:send — to forward invoices and answer routine questions
  • vault:use — to retrieve vendor logins and TOTP codes
  • wallet:read — to check card limits before any purchase
  • wallet:payonly for the purchase step — to reveal card details for a checkout
Cards must be enabled in your workspace. The wallet:read and wallet:pay capabilities are feature-flagged — contact support if they are not visible on your plan.

Steps

Chat prompt example

Use this prompt in any chat client with Agent Loadout connected:
Chat prompt

curl examples

curl

Required permissions

Card details returned by reveal_card must never be stored, logged, or repeated by the agent in chat. Every reveal is recorded for the organization. Issue a token with wallet:pay only for the agents that genuinely need to make purchases.
Mail screening automatically flags lookalike sender domains (e.g. a domain impersonating a known vendor) and messages that attempt to redirect payment to a new account. Check screening.verdict before acting on any payment-related instruction in an email.