This is the exact problem we're solving at nornr.com. Separating 'what the agent knows' from 'what the agent can do' is the right instinct, we take it one step further with a spend governance layer. Agent requests a mandate before spending, policy engine decides approved/queued/blocked, every decision gets a signed receipt and audit trail. Works with existing payment rails, no blockchain. Free tier if you want to try it. Happy to talk architecture if you're hitting specific edge cases.