Tollgate

Problem: an AI agent that pays for APIs, compute or data has to sign transactions, and a full-access key means one prompt injection can drain the wallet. Tollgate is a NEAR contract that holds the funds and gives each agent a function-call access key scoped to one method, spend() on the vault; the key itself is the agent's identity (signer public key). Every spend runs an on-chain policy check: per-transaction and rolling 24h caps, a shared blocklist where reports must carry evidence, optional per-agent allowlists, a freeze switch. Allow transfers, Warn parks the request in an owner approval queue, Block moves nothing and logs the reasons as NEP-297 events without reverting, so the attempt stays on record. An off-chain SafeSigner wrapper checks RPC counterparty signals and the vault's check() before signing. Live on testnet: a prompt-injected agent tried to pay a known drainer and was stopped four ways (wrapper refusal, on-chain block, protocol rejection of a plain transfer, over-cap request queued for the human). NEAR's function-call keys are what make this enforceable by the protocol rather than by the agent's good behavior. 12 unit tests, reproducible README.