Why AI Agents Need a Financial Operating System

Framing: Thought leadership - establishes the problem space Botanary solves

In 2025, AI agents became capable of executing tasks autonomously. They can browse the web, write code, manage files, send emails, interact with APIs. The question that followed immediately was: can they spend money?

The answer turned out to be technically yes and practically unsafe.

Giving an AI agent access to funds today means giving it a private key. A private key is binary: the agent either has full signing authority over the associated wallet, or it has none. There is no middle ground. There is no "you can spend up to $100 per day on infrastructure services." There is no "only interact with these specific contracts." There is no instant revocation without rekeying every system that holds the key.

This is not a software problem waiting for a better API. It's an architectural gap. The infrastructure for humans to delegate bounded financial authority to other humans - contracts, authorization frameworks, regulated financial accounts with defined limits - doesn't have a native equivalent for AI agents operating across multiple blockchains.

What bounded authority actually means

When a company gives an employee a corporate card, the card has limits: a daily spend cap, an approved vendor list, a category restriction. The employee can act within those limits without asking for approval on every purchase. The company can cancel the card instantly. Every transaction is logged. This is bounded authority.

AI agents operating in financial contexts need the same model. Not unlimited keys. Not manual approval for every action. Bounded, revocable, auditable authority - defined by the human, enforced by the infrastructure, independently of anything the AI decides to do.

The word "enforced" carries the weight here. Application-layer enforcement - "we wrote code that checks the agent's actions before executing" - has a well-understood failure mode: the application code can be bypassed, misconfigured, or compromised. Real enforcement happens at the blockchain level, where the policy contract or the account's authorization module physically rejects out-of-scope transactions regardless of what any application layer sends.

The multi-chain complexity

The problem compounds across blockchains. An AI agent that needs to operate across Ethereum, Arbitrum, Sui, and Aptos today faces a different authorization model on each chain. EVM chains use smart account modules and session keys. Sui uses capability objects native to Move's type system. Aptos uses a permissioned signer model, also native to Move.

Each is a valid and robust authorization mechanism within its chain. None of them talk to each other. Authorizing an agent to act across four chains means four separate authorization transactions, four separate revocation mechanisms, and four separate monitoring surfaces.

For a human making a careful, deliberate delegation decision, this friction is manageable. For the businesses and developers trying to deploy production AI agents at scale, it's a bottleneck that limits what they can build.

The opportunity

The AI agent economy is not a future state. AI agents are being used in production today to automate research, outreach, content creation, and code review. The next category is financial automation: agents that pay for services, manage working capital, route payments to vendors, and optimize treasury across chains.

The infrastructure that makes this safe and practical - authorization frameworks that enforce limits at the VM level, payment rails that agents can use without human intervention, stablecoin routing that abstracts away chain complexity - is the missing layer.

This is what Botanary is building.