Administrator guide

For the people who run Lumière PayCheck inside your company: agents, approvals, controls, identity, and audit. The account page is organized in tabs: Overview, Agents, Approvals, Payments, Policies, Identity, People, and Activity. Features your plan doesn't include are shown with the plan they come with, never hidden.

Roles and access

• Owner key: full control. Store it in a password manager; it's also the break-glass login if single sign-on is down. If it's ever exposed, ask us for a new owner access link; the old key stops working as soon as the new one is claimed.
• People sign in with their own key, or with your company login when [single sign-on](#single-sign-on-and-scim) is on. Removing someone takes effect immediately.
• Every change is recorded in the activity log with who made it, including changes by Lumière PayCheck and any time our support opens a read-only view of your workspace.

Overview

Plan and spending, the freeze switch, four numbers (active agents, share of payments that went through PayCheck, items waiting for you, High-risk agents), and Needs your attention: each item has one button that takes you to the fix.

Agents

The inventory lists every agent with its status:

It also shows last seen, the client and version the agent reports, whether it runs our SDK (Enforced by SDK), registered wallets and compliance, risk, and limits. A shared key? warning appears when one key is used from several clients or networks in a week. Filter, search, and download as CSV. A weekly email to your alert address lists stale and expiring agents.

Open an agent for:

• Limits: per-payment, daily and monthly limits, review threshold, allowed sellers, IP allowlist, team and owner. With [policy templates](#policy-templates), pick a template; fields you change by hand become overrides, and Reset to template clears them.
• Wallets: register the wallet the agent pays from. You get a message to sign (free, moves no funds): personal_sign on Base (smart wallets via EIP-1271 work too), ed25519 signMessage on Solana. Paste the signature to verify. Watching starts then; earlier payments aren't imported.
• Payments: every payment from its registered wallets, with status and transaction link.
• Sign-in: its agent key prefix, the client it reports, and key-less sign-in with a platform identity (GitHub Actions, Google Cloud, Azure, Kubernetes).
• Credentials: follow the workspace setting, always anonymous, or never (see [agent credentials](#agent-credentials)).
• Temporary limit: raise its daily limit for up to 72 hours, to at most 10 times its normal daily limit (Admins).
• Risk: Low, Medium or High with the reasons.
• Freeze, New key (the old one stops working at once) and Revoke.

Test keys: decisions are marked test and never count toward spending, caps, alerts, reports, or payment matching; receipts carry "test": true.

How a decision is made

A payment is denied if any of these apply, and every reason is listed on the decision:

• The agent is revoked, expired or frozen, or the request comes from outside its IP allowlist
• The seller isn't one of the agent's allowed sellers, or is on your company blocklist
• The endpoint is failing or risky, or the amount or wallet doesn't match what we observed
• The payment would exceed the agent's per-payment, daily (including an active temporary increase) or monthly limit
• It would exceed a company-wide cap, the maximum single payment, or uses a network you don't allow
• The freeze switch is on, or the workspace is suspended
• Your risk rule is "deny High-risk agents" and the agent is High risk

Otherwise it goes to review (Business and Enterprise) if it's above the agent's review threshold, to a wallet the agent hasn't paid before, or your risk rule sends High-risk agents to a person. Otherwise it's allowed, with a signed receipt that approves that one payment.

Approvals

• Payments waiting for approval: approve or deny; they expire after 24 hours. You can also get a webhook for each new one.
• Temporary limit increases: agents ask with POST /v1/agents/me/limit-increase or the request_limit_increase MCP tool (5 times a day, one at a time, at most 72 hours and 10 times its normal daily limit). You get an email or webhook; an Approver approves or denies. Requests expire after 24 hours. The limit drops back by itself; revoking the agent ends it.
• Access reviews: see below.

Access reviews

Every 30, 60, 90 or 180 days (90 by default) a review lists every active agent. For each one choose Keep, Change limits, or Revoke. Keep all remaining needs a short justification. A reminder goes out on day 7 and the review escalates to admins on day 14. Nothing is revoked automatically unless you turn on "revoke agents nobody reviewed". The first review starts one interval after reviews are turned on, or start one any time. Download signed report gives auditors a JSON file signed with our published key (/.well-known/jwks.json). Business and Enterprise.

Payments outside PayCheck

For agents with a registered wallet, every x402 payment they make (read from public Base and Solana data) is matched to PayCheck's decisions:

One approval covers one payment. Anything but Approved sends an alert and a payment.outside_paycheck event to your security stream. Optional: freeze the agent automatically on "paid after deny", and (Business+) watch every outgoing USDC transfer on Base, not just x402 payments. How often wallets are checked: daily on Builder, hourly on Business, every 10 minutes on Enterprise. If our payment index falls more than 6 hours behind, the Payments tab says so.

Policies

Policy templates

Named rule sets you assign to agents. Three starters come with every workspace (Strict finance, Research low cap, Standard). Changing a template updates every agent using it except their overrides, and the change is logged with before and after values ("template loosened" when caps go up or approvals are removed). A template agents still use can't be deleted. Business and Enterprise.

Payment rules

• High-risk agents: show the risk only (default), send their payments to a person, or deny them.
• Payments outside PayCheck: what to watch, and auto-freeze.
• If PayCheck can't be reached: agents using our SDK don't pay (fail closed, the default), or you allow payments under an amount you choose (up to $10).

Company blocklist, caps and alerts

• Blocklist: sellers and payout wallets that are always denied.
• Caps (Enterprise): company-wide daily and monthly caps, a maximum single payment, and allowed networks, set for your workspace on request and shown on the Overview.
• Alerts: email and/or signed webhook.

Webhooks are signed with your workspace's secret; see verifying webhooks. The security stream sends every decision and these events to your SIEM.

Agent risk

Each agent is Low, Medium or High, always with reasons, from the last 7 days: payments outside PayCheck (paid after a deny counts most), a spending spike (5 times the usual day), 30%+ of requests denied, 5+ new seller wallets in a day, a new network range for an established agent, and repeated requests to D or F grade sellers. Network ranges are stored only as a keyed hash, never the IP address. The level used for each decision is saved with it, so a replay gives the same answer. Business and Enterprise.

Identity

Agent credentials

Let sellers recognize your agents as belonging to a verified company, so they can offer better access or prices. Only the Owner turns this on:

Never shared: limits, people, other agents, payment history, your workspace ID. Verification levels: workspace, domain (add a TXT record paycheck-workspace=<token> at _lumiere-paycheck.<your domain>; rechecked weekly), and business (reviewed by us, Enterprise). Credentials last 15 minutes and only work with the agent's registered wallet. The per-seller ID stops sellers matching IDs, but every seller sees the same wallet address, so sellers that compare notes can still tell it's the same agent. Turning credentials off, excluding an agent, freezing or revoking it fails every outstanding credential at once; sellers are only told "revoked", never why. Agents get one with POST /v1/agents/credential or the get_agent_credential MCP tool. Business and Enterprise.

Single sign-on and SCIM

Enterprise. In your identity provider (Entra ID, Okta, Google Workspace, any OpenID Connect provider) register a web app with the redirect URI shown on the Identity tab and scopes openid email profile. First verify your email domain under Domains (a DNS TXT record), so no one else can claim it. Then enter the issuer URL, client ID and client secret (stored encrypted), your sign-in domains (verified ones, or their subdomains), and map groups to roles (viewer, approver, admin; SSO never grants owner). People in no mapped group can't sign in unless you choose a default role. Your identity provider must confirm the email address (email_verified; on Entra ID the UPN is used). After someone's first sign-in, their email only works with that same identity-provider account. People sign in with their work email on the account page, and a sign-in only finishes in the browser that started it. Sessions last 12 hours.

SCIM 2.0: create a token on the Identity tab (shown once) and give your identity provider the SCIM base URL and token. Users are created, updated and deactivated automatically; roles come from the SCIM roles attribute or your SSO default. Deactivating someone removes access and ends their sessions immediately; SSO never re-adds a person who was removed. SCIM can bring back only people SCIM removed (someone an administrator removed stays removed), and a restored person signs in with SSO: their old personal key never works again. SAML isn't offered yet.

Reports and audit

• Spending by team (CSV by agent), recent decisions, and CSV export of the audit trail (Business and Enterprise).
• Replay: re-evaluate any decision from its stored inputs.
• Verify audit trail: recomputes the hash chain and reports the first altered or missing record, if any.
• Agent inventory CSV and signed access-review reports for auditors.

Retention

Decisions are kept for your plan's audit period (30 days on Builder, 1 year on Business, custom on Enterprise). Full retention details are on the security page.