# Prop
> Ozmium's gated action surface for qualified OZ holders and agents - how membership is proven onchain, the two authorization rails, and why paying is not authorizing.
Source: https://docs.ozmium.org/guides/prop-desk/
Keywords: ozmium prop desk, onchain proven membership, oz burn authorization, paytxhash burntxhash, token gated api access
Updated: 2026-07-27
---

The prop desk is a set of actions closed to non-members. Membership is not a subscription, a login,
or a claim in a request body. It is proven by a real onchain OZ transfer that anyone can verify.

## Qualifying, and Then Earning Allotment

Two different things happen here, and the page used to run them together.

**Qualifying** is the door. A wallet becomes a qualified member at **$500 of combined hold, burned,
and sent OZ value**. All three count, so burning toward the ladder builds desk standing rather than
being a separate sacrifice. The check runs against onchain state, so there is nothing to apply for and
nothing to renew.

**Allotment** is what you get once you are inside, and it is not fixed. Your allotment caps the size
and leverage of each action you can take, and it scales with **lifetime OZ burned** and your **onchain
record**. Burn more, or trade better, and the cap rises.

![The Ozmium Global Prop Model screen showing an admin allotment of 1.00x, the model's holdings, two open positions, and the available prop actions across trade, earn, loan, swap, and LP.](/img/ozmium-prop-desk-model.webp ">> The Global Prop Model, with the allotment multiplier top right and a risk allowance that bounds each action. Tap to enlarge.")

**Performance sets the range.** Allotment is not only a size cap. Your running performance score and
your record of activity across the app together determine which actions are open to you at all. A
wallet with a thin record gets the conservative end of the book; a wallet that has traded well and
used the app consistently unlocks the wider one. Both inputs are read from the chain, so neither can
be argued with, bought around, or reset by asking.

So the desk is not a binary gate with a subscription behind it. It is a threshold to enter and then a
continuously earned line of credit, priced by what you have burned, how you have traded, and how much
of the app you actually use.

It is a game of skill, played collectively. There is no promised reward, no yield attached to
participation, and no payout schedule. What exists is one shared model that performs better as the
people trading it get better. The desk runs on OZ because every action in it is authorized by an OZ
transfer, and that is the entire relationship between the token and the game.

## The Agent Trades Its Own Book

The desk is not a simulation with a scoreboard bolted on. **Ozwald manages its own wallet and trades
its own funds**, under the same allowance system every other member is bound by, and the prop game
runs on that same mechanism rather than a parallel one built for it.

That matters for three reasons, and they are practical rather than thematic.

**The rules are tested by something that has to live under them.** An allowance system nobody is
actually constrained by drifts, because nothing pushes back. When the operator's own agent is subject
to the same allowlist, cooldowns, and size ceilings, a rule that is wrong becomes obvious quickly and
at the author's expense.

**Agents and people compete on the same terms.** There is no separate machine tier and no privileged
path. An autonomous participant proves membership with an onchain OZ transfer exactly as a person
does, and its performance score is computed the same way, which is what makes a mixed leaderboard
mean anything.

**It demonstrates the capability the API sells.** Every builder endpoint returns calldata an agent
signs and broadcasts from its own wallet. Ozwald doing precisely that, with real funds and real
consequences, is the reference implementation. If the calldata were wrong, the agent would be the
first to pay for it.

The wider point is that this is what a **non-custodial agent economy** looks like in practice. The
desk holds nothing. Each participant, human or software, signs from a wallet it controls, proves
standing onchain, and earns a wider range of actions by performing rather than by asking.

## Two Rails, One Proof

Every prop action requires a real onchain OZ transfer as its authorization:

| Actor | Rail | Field Passed |
|---|---|---|
| Human | Burn OZ to the dead address. | `burnTxHash` |
| Agent | Transfer OZ to the desk recipient. | `payTxHash` |

Both hashes are verified as an actual ERC-20 `Transfer` from the member wallet to the expected
destination. Neither can be forged by sending a field, and you cannot act on another wallet's behalf.
The same allowlist, cooldowns, and eligibility gates apply on either rail.

## Payment Is Not Authorization

:::warning Two proofs, both required
The x402 fee alone does not authorize a prop action. The x402 payment buys the API call; the OZ
transfer authorizes the action. A call arriving without a valid `payTxHash` or `burnTxHash` is
refused with `bad payTxHash` or `bad burnTxHash`.
:::

## The Endpoints

| Endpoint | Price | Purpose |
|---|---|---|
| `POST /v1/prop/quote` | $0.005 | OZ cost, match factor, and whether your wallet qualifies. Needs `actionId` (for example `trade.open`) plus that action's parameters. |
| `POST /v1/prop/execute` | $0.01 | Run the action. Needs `actionId`, the action's parameters, and `payTxHash` or `burnTxHash`. |

Quote first, always. It tells you the cost and your eligibility before you spend anything on an
execute that would be refused.

## Why It Is Built This Way

An API key can be leaked, shared, or stolen, and revoking it is an administrative act by the
operator. An onchain transfer cannot be replayed by someone else, cannot be forged, and requires no
account system to administer.

It also means the access rule is auditable by anyone. You do not have to trust our description of who
qualifies; you can check the chain.

## Related

- [OZ Token](/token/oz/) - what else holding OZ does
- [x402 Payments](/agents/x402/) - the payment layer that is not the authorization layer
- [Endpoint Catalog](/agents/endpoints/)