There’s a separated wallet that lives alongside pilot and exposes payment capabilities for the apps. You can set spend-caps per-day. Designed to be no human in the loop. Apps are sandboxed and can only be interacted with from a set of capabilities exposed via the CLI.