One parent budget, fanned out into capped, revocable, per-second allowances across a whole network of service nodes — settled by signed vouchers, enforced at the money layer.
A workflow today is rarely one caller and one API. It is a tree: an orchestrator delegates to workers, workers call tools, tools call other services. Dynamo makes that tree payable and governable as one object: the parent budget is the funded ceiling, every branch is a child allowance with its own cap, rate envelope, and instant revocation, and every metered unit of work is a cryptographically signed voucher. Revoke a branch and its whole subtree is unsettleable from that instant — structurally, not by request.
npm install @dynamoprotocol/guard @dynamoprotocol/sdk
npx @dynamoprotocol/guard up # needs your instance: DYNAMO_CORE_URL + OWNER_API_TOKENThat is the guard: a base URL and a key with a hard cap in front of any OpenAI-compatible endpoint, enforced by your own hosted Dynamo instance in Control Mode (no money anywhere). The guard runs on your machine — your prompts and payloads never leave it; the instance sees metering facts only. When the cap is gone the answer is HTTP 402 — not an alert, not a report at the end of the month. From there, the same code runs on real settlement rails when a money mode is enabled on your instance. No instance yet? Request one.
Spend dashboards and usage counters answer "what happened?" — after it happened. Dynamo's enforcement is a ceiling made of money: the budget IS the funded amount, allowances are slices of it, and a unit of work that exceeds cap, rate, or a revoked allowance cannot be settled at all. The difference is not reporting quality; it is when the answer arrives — before the money moves, instead of after.
An agent loop that retries itself into an accelerating burn is halted by the rate-anomaly detector and the rate envelope mid-loop, while the budget is still mostly intact — the caller gets 402s, and the ledger shows exactly what was settled and why the rest was refused.
The OWASP Agentic Security Initiative threat classes map to enforcement that already exists at the settlement layer:
| OWASP ASI class | Dynamo machinery |
|---|---|
| ASI01 — compromised delegation chain | One revoke kills the whole delegated subtree; post-revocation vouchers are structurally unsettleable |
| ASI02 — tool misuse / hijacked agent | Anomalous burn halts at the rate envelope + anomaly detector; the halt is a money-layer refusal, not a heuristic flag |
| ASI03 — identity & privilege abuse | A leaked session key is scoped to ONE stream: foreign-stream vouchers are refused, and the stream's own cap bounds the damage |
Settlement is verified-value settlement on objective facts: signed oracle attestations of latency, error rate, availability, unit counts, completion — never subjective quality signals. SLA-failed units are never paid. Refunds are buyer-whole-first from held funds, and no Dynamo fee is earned before its units are final (holdback & refunds).
Every TypeScript sample on this site is executed by CI against the current SDK — what you read is what runs.