The Demo Deny, Explained

Every new Free account gets a demo-agent wallet with a $10 per-transaction limit and zero balance — no deposit required.

The first thing the dashboard asks you to do is send a $40 request through that agent. It gets denied, because $40 is over the $10 limit. That denial writes a real row to your account's hash-chained audit trail, and you get a shareable receipt link for it — the same mechanism used for every real spend decision on Valta, not a canned demo screen.

Why a deny, not a deposit

The core claim of this product is narrow: a hard rule is checked before an agent's spend goes through. The fastest way to prove that claim is true is to watch it actually stop something — not to look at a clean, empty dashboard and take the claim on faith.

Because the check runs before the balance check (see How Valta Works), this works with a completely unfunded wallet. Funding only matters once you want an agent to actually spend money — the policy check itself doesn't need a balance to enforce a limit.

What actually happened

1. POST /api/v1/spend (or the SDK's client.spend()) evaluated the request against the demo-agent wallet's policy: per-transaction limit $10, requested $40.
2. The request was denied before any balance was touched. The response reason names the exact limit that was hit.
3. A real entry was written to audit_log, chained to the account's prior entry hash.
4. A public, no-login receipt link was generated for that entry, so you (or anyone you send the link to) can see the exact decision without a Valta account.

Doing this yourself, outside the dashboard

import { ValtaClient } from 'valta-sdk'

const valta = new ValtaClient({ apiKey: process.env.VALTA_API_KEY! })

const result = await valta.spend({
  agent: 'demo-agent',
  amount: 40,
  purpose: 'demo deny',
})

console.log(result.approved) // false
console.log(result.reason)   // "Amount $40 exceeds per-transaction limit of $10..."

Once you've seen this work, the next real step is attaching this same check to your own agent — see Build Your First Governed Agent — or, if your agent keeps its own OpenAI/Anthropic key and you don't want a Valta wallet at all, Cap is the cooperative version of the same idea: call allow() before your own paid API call, and Valta records the decision without ever seeing your provider key. Cap v1 is cooperative — nothing stops your code from skipping allow() and calling the provider directly, so it's only a real check if your code actually calls it.