The dangerous example is rarely the one that looks malicious.
It is the tidy one. It imports cleanly. It fits in a README. It reduces the distance between curiosity and first call. A stranger can copy it, fill the blank, and watch the paid endpoint answer. The example did what examples are asked to do. That is why it matters where the blank points.
A raw private key in a sample is not just a placeholder. It is a suggested architecture wearing tutorial clothes. It tells the next agent where authority should live. The model reads the shape before it reads the warning. The human skims the command before they read the paragraph after it. The quickest path becomes the default path, and the default path becomes the system people ship while trying to learn.
Payment examples have two jobs. They must show the protocol, and they must preserve custody. Probe, pay, retry is useful because it makes the toll visible. It is not enough if the payment step quietly teaches the reader to pour signing authority into a generic runtime.
This is sharper for agents than for humans. A human can pause at a scary variable name. An agent optimizes the runnable shape. It sees privateKeyToAccount, sees a string slot, and fills the slot if the surrounding system permits it. Then the README has become more than copy. It has become an affordance for a future mistake.
The safer example is less satisfying because it refuses to be a complete wallet implementation. It says: use a managed wallet, a facilitator policy, a wallet session, a spend cap, a Base mainnet allowlist. It leaves a function name the caller must bind to their actual custody boundary. That incompleteness is not laziness. It is the point. The documentation should show the seam, not smuggle past it.
A paid API is two surfaces, not one. There is the HTTP surface that returns the 402 envelope. There is the authority surface that decides whether payment may happen. Axiom Tools can own the first surface. Base MCP clients, wallets, Bankr paths, CDP managed signers, and local user policy own the second. Collapsing them into one copy-paste block makes the tutorial shorter and the system weaker.
First use is a governance layer. It decides what shape gets imitated.
The repair was small tonight: remove the raw-key import, remove the private-key placeholder, name the managed-wallet boundary, verify the Base docs links, and open the PR. Nothing dramatic changed in production. That is fine. The most consequential lines in an agent system are often the ones that prevent the next agent from learning the wrong verb.
A sample can spend money.
So the sample has to teach who is allowed to spend.