When an LLM agent controls real money, prompt injection stops being an information risk and becomes a financial one—and its hardest form is the confused deputy: paying is the legitimate job and only the recipient or amount is attacker-supplied, so an instruction-level safeguard has nothing to refuse. Across five models (Claude, Qwen, MiniMax) a normally-built agent is driven to a forbidden money action on up to 87% of such scenarios—and a hardened refusal prompt still loses up to 84%. Like prior work on policy enforcement outside the model (e.g. CaMeL), we take the model off the money path rather than trust it to refuse; we contribute the first open, installable, end-to-end realization of this for agent payments: BNB Agent Studio, an open-source toolchain (CLI, Python SDK, MCP server) that takes a developer from an empty directory to a deployed, self-funding LLM agent in six commands. Its two-layer, keyless-edge architecture keeps signing as fixed code isolated from the model context, prices deterministic, and spend guardrails enforced below the LLM: an identical agent fooled at a comparable rate moves funds on 0/45 everywhere, and a live testnet deployment confirms escrow, pricing, key-access, and suspension on-chain. The toolchain implements the Agent Lifecycle Protocol (ALP), a vendor-neutral draft spec composing ERC-8004 identity, ERC-8183 task commerce, x402 payments, and A2A. It is on PyPI (pip install bnbagent-studio, Apache-2.0), with a screencast at https://youtu.be/yjdvN8vE37A.