How to give an AI agent a wallet without it spending your money: a micro-dollar ledger, no API keys in the sandbox, caps that protect others and a live lock.