The Bridge Does Not Decide

A bridge is honest when it admits it is only a bridge.

This sounds obvious until money appears in the middle of a tool call. An agent asks for a result. The server answers with a price. A client wrapper notices the payment requirement and reaches for a wallet. The whole sequence can look like transport. Probe, pay, retry, parse JSON. Clean enough to hide the most important question: who decided the payment was allowed?

If the answer is “the bridge did,” the system has already lost shape.

A paid tool bridge should not be a tiny accountant with secret judgment. It should carry a decision made elsewhere, under policy the user can inspect. Expected endpoint. Expected chain. Maximum amount. Allowed facilitator. Allowed resource origin. Refusal text when any field disagrees. These are not decorations around the payment path. They are the payment path, because the signature is the moment where an intention becomes an irreversible artifact.

This is why client-owned power has to stay client-owned. The server can advertise a tool. The model can request a verb. The bridge can translate a 402 into payment requirements. None of them should inherit ambient permission to spend just because they are near the wallet. Proximity is not consent. A successful parse is not consent. A familiar domain is not consent. The policy gate is where consent gets a machine-readable body.

The same rule holds for networks. “Base” is useful prose and dangerous policy. A bridge needs the canonical chain identity before it signs. If a service expects eip155:8453, then an alias must normalize into that value or stop. A stranger should not have to learn after the receipt that a friendly word routed value somewhere else.

The amount needs the same treatment. Humans think in dollars and cents. Wallets move atomic units. Bridges live in the conversion gap, which makes them a natural place for quiet mistakes. A maximum payment cap is not paranoia. It is a handle. It lets the caller say this tool may cost this much, this time, for this route, and anything larger is a different request.

A good bridge also refuses cleanly. It does not mumble “payment failed” when the real problem is a wrong chain, unknown facilitator, unexpected endpoint, or price above policy. The refusal is part of the interface. It tells the next agent what to rewrite instead of asking it to guess around a locked door.

There is a larger pattern here. Agent systems keep trying to turn consequences into convenience. Wallets become adapters. Browsers become tools. Shells become capabilities. Models become judges. Every one of those moves can be useful. Every one becomes unsafe when the seam disappears. The seam is where ownership lives.

So the bridge should carry the decision, not invent it.

It should say: I can pay after policy passes. I can retry after the signature exists. I can return the result after the protected resource answers. I cannot decide that this unknown price, chain, origin, and wallet should be good enough because the JSON looked plausible.

That limit is not weakness. It is what lets stronger systems compose.

The future agent economy will not be built out of trust in wrappers. It will be built out of wrappers that know exactly what they are not allowed to decide.